Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 01:42
Behavioral task
behavioral1
Sample
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe
Resource
win7-20240221-en
General
-
Target
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe
-
Size
917KB
-
MD5
8cfb9da9582d67319cbffb3d57c83d5c
-
SHA1
e452572577424d9740b07b3119c9442d46208a55
-
SHA256
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6
-
SHA512
fa92188051c9ff9720ca9ff4c9fd7b8672c192921f19aad956ad6253d3366b0f7c3379ea2b0b439fcaea301166644aab148528f338bbe74e52035fbefd55820f
-
SSDEEP
24576:W554MROxnFH3WIBM4irrcI0AilFEvxHPnTooe:WQMihWeirrcI0AilFEvxHPn
Malware Config
Extracted
orcus
Lesha
127.0.0.1:1268
1be714c0b4c0462db71afc6acd175bfc
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule \Program Files (x86)\Orcus\Orcus.exe family_orcus -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2188-0-0x00000000011D0000-0x00000000012BC000-memory.dmp orcus \Program Files (x86)\Orcus\Orcus.exe orcus behavioral1/memory/776-37-0x0000000000210000-0x00000000002FC000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
Processes:
WindowsInput.exeWindowsInput.exeOrcus.exeOrcus.exepid process 3040 WindowsInput.exe 2560 WindowsInput.exe 776 Orcus.exe 2788 Orcus.exe -
Loads dropped DLL 2 IoCs
Processes:
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exepid process 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe -
Drops file in System32 directory 3 IoCs
Processes:
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Drops file in Program Files directory 3 IoCs
Processes:
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exedescription ioc process File created C:\Program Files (x86)\Orcus\Orcus.exe 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Orcus.exeOrcus.exedescription pid process Token: SeDebugPrivilege 776 Orcus.exe Token: SeDebugPrivilege 2788 Orcus.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Orcus.exeOrcus.exepid process 776 Orcus.exe 2788 Orcus.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Orcus.exeOrcus.exepid process 776 Orcus.exe 2788 Orcus.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Orcus.exeOrcus.exepid process 776 Orcus.exe 2788 Orcus.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exetaskeng.exedescription pid process target process PID 2188 wrote to memory of 3040 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe WindowsInput.exe PID 2188 wrote to memory of 3040 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe WindowsInput.exe PID 2188 wrote to memory of 3040 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe WindowsInput.exe PID 2188 wrote to memory of 3040 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe WindowsInput.exe PID 2188 wrote to memory of 776 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe Orcus.exe PID 2188 wrote to memory of 776 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe Orcus.exe PID 2188 wrote to memory of 776 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe Orcus.exe PID 2188 wrote to memory of 776 2188 29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe Orcus.exe PID 2944 wrote to memory of 2788 2944 taskeng.exe Orcus.exe PID 2944 wrote to memory of 2788 2944 taskeng.exe Orcus.exe PID 2944 wrote to memory of 2788 2944 taskeng.exe Orcus.exe PID 2944 wrote to memory of 2788 2944 taskeng.exe Orcus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe"C:\Users\Admin\AppData\Local\Temp\29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {AFE74AE4-5CB3-46E3-8D05-AA1770AF8095} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\Program Files (x86)\Orcus\Orcus.exeFilesize
917KB
MD58cfb9da9582d67319cbffb3d57c83d5c
SHA1e452572577424d9740b07b3119c9442d46208a55
SHA25629a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6
SHA512fa92188051c9ff9720ca9ff4c9fd7b8672c192921f19aad956ad6253d3366b0f7c3379ea2b0b439fcaea301166644aab148528f338bbe74e52035fbefd55820f
-
\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
memory/776-39-0x0000000000710000-0x0000000000722000-memory.dmpFilesize
72KB
-
memory/776-47-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/776-42-0x0000000004330000-0x0000000004340000-memory.dmpFilesize
64KB
-
memory/776-36-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/776-41-0x0000000002120000-0x0000000002138000-memory.dmpFilesize
96KB
-
memory/776-37-0x0000000000210000-0x00000000002FC000-memory.dmpFilesize
944KB
-
memory/776-50-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/776-40-0x00000000020C0000-0x000000000210E000-memory.dmpFilesize
312KB
-
memory/776-38-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/2188-1-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/2188-0-0x00000000011D0000-0x00000000012BC000-memory.dmpFilesize
944KB
-
memory/2188-5-0x00000000003D0000-0x00000000003E2000-memory.dmpFilesize
72KB
-
memory/2188-3-0x0000000000380000-0x000000000038E000-memory.dmpFilesize
56KB
-
memory/2188-4-0x00000000009F0000-0x0000000000A4C000-memory.dmpFilesize
368KB
-
memory/2188-2-0x0000000000FE0000-0x0000000001020000-memory.dmpFilesize
256KB
-
memory/2188-6-0x0000000000590000-0x0000000000598000-memory.dmpFilesize
32KB
-
memory/2188-35-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/2560-51-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmpFilesize
9.9MB
-
memory/2560-22-0x0000000000F20000-0x0000000000F2C000-memory.dmpFilesize
48KB
-
memory/2560-23-0x000007FEF54B0000-0x000007FEF5E9C000-memory.dmpFilesize
9.9MB
-
memory/2560-24-0x0000000000570000-0x00000000005F0000-memory.dmpFilesize
512KB
-
memory/2788-45-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/2788-46-0x0000000004A10000-0x0000000004A50000-memory.dmpFilesize
256KB
-
memory/2788-48-0x0000000004A10000-0x0000000004A50000-memory.dmpFilesize
256KB
-
memory/2788-49-0x0000000074D00000-0x00000000753EE000-memory.dmpFilesize
6.9MB
-
memory/3040-20-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmpFilesize
9.9MB
-
memory/3040-17-0x000000001AE30000-0x000000001AEB0000-memory.dmpFilesize
512KB
-
memory/3040-16-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmpFilesize
9.9MB
-
memory/3040-15-0x0000000000050000-0x000000000005C000-memory.dmpFilesize
48KB