Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 02:01
Behavioral task
behavioral1
Sample
9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe
Resource
win7-20240215-en
General
-
Target
9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe
-
Size
3.0MB
-
MD5
c636ea3b6f9877ba652b6eff45951533
-
SHA1
f0cb217fe930c1f55bdd64633b111785df4816c6
-
SHA256
9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c
-
SHA512
b40941fb08547aa8492ce1fb98cd9ad0b51d7d527e69101fc92e7c17fa56ddb1a7503bb39eae4b0e79762edafaee1ae14db2ecbe4c5b7e3b38eace8c6674251b
-
SSDEEP
49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:64770
sudo_acbjyh476x3aev1tpdb5g04kwe8v7vcj
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
C:\Program Files (x86)\Tlauncher.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023404-13.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/3716-0-0x0000000000AC0000-0x0000000000DBE000-memory.dmp orcus behavioral2/files/0x0008000000023404-13.dat orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe -
Executes dropped EXE 4 IoCs
pid Process 4412 Tlauncher.exe 1640 Tlauncher.exe 4152 Tlauncher.exe 4844 Tlauncher.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4412 set thread context of 796 4412 Tlauncher.exe 91 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Tlauncher.exe.config 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe File created C:\Program Files (x86)\Tlauncher.exe 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe File opened for modification C:\Program Files (x86)\Tlauncher.exe 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3716 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe 4412 Tlauncher.exe 4412 Tlauncher.exe 796 installutil.exe 796 installutil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3716 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe Token: SeDebugPrivilege 4412 Tlauncher.exe Token: SeDebugPrivilege 796 installutil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3716 wrote to memory of 4412 3716 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe 89 PID 3716 wrote to memory of 4412 3716 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe 89 PID 3716 wrote to memory of 4412 3716 9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe 89 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91 PID 4412 wrote to memory of 796 4412 Tlauncher.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe"C:\Users\Admin\AppData\Local\Temp\9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Program Files (x86)\Tlauncher.exe"C:\Program Files (x86)\Tlauncher.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
-
C:\Program Files (x86)\Tlauncher.exe"C:\Program Files (x86)\Tlauncher.exe"1⤵
- Executes dropped EXE
PID:1640
-
C:\Program Files (x86)\Tlauncher.exe"C:\Program Files (x86)\Tlauncher.exe"1⤵
- Executes dropped EXE
PID:4152
-
C:\Program Files (x86)\Tlauncher.exe"C:\Program Files (x86)\Tlauncher.exe"1⤵
- Executes dropped EXE
PID:4844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5c636ea3b6f9877ba652b6eff45951533
SHA1f0cb217fe930c1f55bdd64633b111785df4816c6
SHA2569fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c
SHA512b40941fb08547aa8492ce1fb98cd9ad0b51d7d527e69101fc92e7c17fa56ddb1a7503bb39eae4b0e79762edafaee1ae14db2ecbe4c5b7e3b38eace8c6674251b
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
1KB
MD5663b8d5469caa4489d463aa9bc18124f
SHA1e57123a7d969115853ea631a3b33826335025d28
SHA2567b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8
SHA51245e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55