Overview

overview

10

Static

static

3

b64d21aaa7...d7.exe

windows7-x64

10

b64d21aaa7...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2024 01:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7.exe

  • Size

    6.9MB

  • MD5

    e173c05c4a3e872292b1f21e6d1a633a

  • SHA1

    60c97091d291855e9dcd3757ddc3a78daae1ac18

  • SHA256

    b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7

  • SHA512

    34acb6f310646af5ae973db4612e001ec2078a0c0f2758f9dafce18b34e5f703cedd3d316ed458bde47b9c31149e46fbddb16e2c0320e19e426389648828a5af

  • SSDEEP

    98304:kb0PkiC5Sofp5XJdP/0Gu4STi94vlTKlrfxgLQFMjAe6shVJRzux84i:kYlMJdXS4STiqlTKlTyLKMkpsLvux8j

Score
10/10
orcusratspywarestealer

Malware Config

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcurs Rat Executable 3 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7.exe
    "C:\Users\Admin\AppData\Local\Temp\b64d21aaa7c4d1b39c3210c505a356ae2b8f62546a4582aea9b8b4bde1331cd7.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      2⤵
        PID:2236

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/212-1-0x0000000000C60000-0x00000000020D6000-memory.dmp
      Filesize

      20.5MB

      Download
    • memory/212-2-0x0000000002700000-0x0000000002701000-memory.dmp
      Filesize

      4KB

      Download
    • memory/212-4-0x0000000000C60000-0x00000000020D6000-memory.dmp
      Filesize

      20.5MB

      Download
    • memory/212-0-0x00000000026F0000-0x00000000026F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/212-7-0x0000000000C60000-0x00000000020D6000-memory.dmp
      Filesize

      20.5MB

      Download