Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe
Resource
win7-20240221-en
General
-
Target
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe
-
Size
2.6MB
-
MD5
c11bda86091f8c46dda406de7b41da14
-
SHA1
8290f397fb1f00332d162fdd01df70c947cc0c05
-
SHA256
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a
-
SHA512
f6771c96623130228884fb9f8e0bad2480252ea379802dee514e91f2c372b95640020652fdf3b7dfe73f66456fb4d2c18acf874ca1ebd6099cd2cc48baa34726
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx8:Hh+ZkldoPKiYdqd6U
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2044-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 2 IoCs
Processes:
setspn.exesetspn.exepid process 3740 setspn.exe 1612 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4664-0-0x0000000000D70000-0x000000000101A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/3740-24-0x0000000000C30000-0x0000000000EDA000-memory.dmp autoit_exe behavioral2/memory/1612-36-0x0000000000C30000-0x0000000000EDA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exesetspn.exesetspn.exedescription pid process target process PID 4664 set thread context of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 3740 set thread context of 2472 3740 setspn.exe RegSvcs.exe PID 1612 set thread context of 4640 1612 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4916 schtasks.exe 1416 schtasks.exe 4784 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exesetspn.exesetspn.exepid process 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe 3740 setspn.exe 3740 setspn.exe 3740 setspn.exe 3740 setspn.exe 1612 setspn.exe 1612 setspn.exe 1612 setspn.exe 1612 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2044 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2044 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exesetspn.exesetspn.exedescription pid process target process PID 4664 wrote to memory of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 4664 wrote to memory of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 4664 wrote to memory of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 4664 wrote to memory of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 4664 wrote to memory of 2044 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe RegSvcs.exe PID 4664 wrote to memory of 4916 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe schtasks.exe PID 4664 wrote to memory of 4916 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe schtasks.exe PID 4664 wrote to memory of 4916 4664 031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe schtasks.exe PID 3740 wrote to memory of 2472 3740 setspn.exe RegSvcs.exe PID 3740 wrote to memory of 2472 3740 setspn.exe RegSvcs.exe PID 3740 wrote to memory of 2472 3740 setspn.exe RegSvcs.exe PID 3740 wrote to memory of 2472 3740 setspn.exe RegSvcs.exe PID 3740 wrote to memory of 2472 3740 setspn.exe RegSvcs.exe PID 3740 wrote to memory of 1416 3740 setspn.exe schtasks.exe PID 3740 wrote to memory of 1416 3740 setspn.exe schtasks.exe PID 3740 wrote to memory of 1416 3740 setspn.exe schtasks.exe PID 1612 wrote to memory of 4640 1612 setspn.exe RegSvcs.exe PID 1612 wrote to memory of 4640 1612 setspn.exe RegSvcs.exe PID 1612 wrote to memory of 4640 1612 setspn.exe RegSvcs.exe PID 1612 wrote to memory of 4640 1612 setspn.exe RegSvcs.exe PID 1612 wrote to memory of 4640 1612 setspn.exe RegSvcs.exe PID 1612 wrote to memory of 4784 1612 setspn.exe schtasks.exe PID 1612 wrote to memory of 4784 1612 setspn.exe schtasks.exe PID 1612 wrote to memory of 4784 1612 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe"C:\Users\Admin\AppData\Local\Temp\031ac5248c2853ad023675f17c428ce7461cdeba617b356348635d26178a3a7a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.logFilesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5d30f1678f7174b02434ab5d01f8cada4
SHA1334eda3a32f49cac63512e3e8d01eb6515eded2a
SHA2563fcc639d8661db7473c02f98b75df9966a93c26d9adba6bcbe6c0b1fbff3aba0
SHA512bde871c51d3a980a7731a61b307417e3371d96fc17ba90b1830fac1f5cabb684722a9500ceef03b069eba42bd4eb15d414827d9fa05117275bdcea4888c6b6b2
-
memory/1612-36-0x0000000000C30000-0x0000000000EDA000-memory.dmpFilesize
2.7MB
-
memory/2044-18-0x0000000005F50000-0x0000000006112000-memory.dmpFilesize
1.8MB
-
memory/2044-20-0x00000000057C0000-0x00000000057CA000-memory.dmpFilesize
40KB
-
memory/2044-8-0x0000000002AA0000-0x0000000002AAE000-memory.dmpFilesize
56KB
-
memory/2044-10-0x0000000004F20000-0x0000000004F7C000-memory.dmpFilesize
368KB
-
memory/2044-11-0x00000000057D0000-0x0000000005D74000-memory.dmpFilesize
5.6MB
-
memory/2044-12-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/2044-15-0x0000000005070000-0x0000000005082000-memory.dmpFilesize
72KB
-
memory/2044-16-0x0000000005080000-0x0000000005088000-memory.dmpFilesize
32KB
-
memory/2044-17-0x00000000051D0000-0x00000000051E8000-memory.dmpFilesize
96KB
-
memory/2044-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/2044-19-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/2044-9-0x0000000005210000-0x0000000005220000-memory.dmpFilesize
64KB
-
memory/2044-21-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/2044-22-0x0000000005210000-0x0000000005220000-memory.dmpFilesize
64KB
-
memory/2044-7-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/2472-31-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/2472-32-0x0000000005420000-0x0000000005430000-memory.dmpFilesize
64KB
-
memory/2472-34-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/3740-24-0x0000000000C30000-0x0000000000EDA000-memory.dmpFilesize
2.7MB
-
memory/4640-43-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/4640-44-0x00000000057D0000-0x00000000057E0000-memory.dmpFilesize
64KB
-
memory/4640-45-0x0000000073EE0000-0x0000000074690000-memory.dmpFilesize
7.7MB
-
memory/4664-0-0x0000000000D70000-0x000000000101A000-memory.dmpFilesize
2.7MB
-
memory/4664-1-0x00000000015D0000-0x00000000015D1000-memory.dmpFilesize
4KB