Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 02:11
Static task
static1
Behavioral task
behavioral1
Sample
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe
Resource
win7-20240215-en
General
-
Target
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe
-
Size
2.6MB
-
MD5
942e6d4d79fafc99f4339e0cd957675d
-
SHA1
03f5cadf461749cd06cd4defd93e31e3ce9e716f
-
SHA256
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621
-
SHA512
1192451b24280780b65881c4a27b09cbe98fccc836819832554796d0dd966ab29dfe27afd0476efb2f73689b992813a8e63f1525c49395a5d41e3a90493a3130
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx9:Hh+ZkldoPKiYdqd6l
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-2-0x00000000007A0000-0x000000000088A000-memory.dmp orcus behavioral2/memory/1872-25-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral2/memory/4116-37-0x0000000000500000-0x00000000005EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exesetspn.exesetspn.exesetspn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setspn.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2016 setspn.exe 1988 setspn.exe 244 setspn.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4896-0-0x0000000000CD0000-0x0000000000F7A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/2016-22-0x0000000000C70000-0x0000000000F1A000-memory.dmp autoit_exe behavioral2/memory/1988-36-0x0000000000C70000-0x0000000000F1A000-memory.dmp autoit_exe behavioral2/memory/4116-44-0x0000000004A50000-0x0000000004A60000-memory.dmp autoit_exe behavioral2/memory/244-47-0x0000000000C70000-0x0000000000F1A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4896 set thread context of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 2016 set thread context of 1872 2016 setspn.exe RegSvcs.exe PID 1988 set thread context of 4116 1988 setspn.exe RegSvcs.exe PID 244 set thread context of 5028 244 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4724 schtasks.exe 3596 schtasks.exe 1812 schtasks.exe 4504 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exesetspn.exesetspn.exesetspn.exepid process 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe 2016 setspn.exe 2016 setspn.exe 2016 setspn.exe 2016 setspn.exe 1988 setspn.exe 1988 setspn.exe 1988 setspn.exe 1988 setspn.exe 244 setspn.exe 244 setspn.exe 244 setspn.exe 244 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3676 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3676 RegSvcs.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4896 wrote to memory of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 4896 wrote to memory of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 4896 wrote to memory of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 4896 wrote to memory of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 4896 wrote to memory of 3676 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe RegSvcs.exe PID 4896 wrote to memory of 4724 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe schtasks.exe PID 4896 wrote to memory of 4724 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe schtasks.exe PID 4896 wrote to memory of 4724 4896 f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe schtasks.exe PID 2016 wrote to memory of 1872 2016 setspn.exe RegSvcs.exe PID 2016 wrote to memory of 1872 2016 setspn.exe RegSvcs.exe PID 2016 wrote to memory of 1872 2016 setspn.exe RegSvcs.exe PID 2016 wrote to memory of 1872 2016 setspn.exe RegSvcs.exe PID 2016 wrote to memory of 1872 2016 setspn.exe RegSvcs.exe PID 2016 wrote to memory of 3596 2016 setspn.exe schtasks.exe PID 2016 wrote to memory of 3596 2016 setspn.exe schtasks.exe PID 2016 wrote to memory of 3596 2016 setspn.exe schtasks.exe PID 1988 wrote to memory of 4116 1988 setspn.exe RegSvcs.exe PID 1988 wrote to memory of 4116 1988 setspn.exe RegSvcs.exe PID 1988 wrote to memory of 4116 1988 setspn.exe RegSvcs.exe PID 1988 wrote to memory of 4116 1988 setspn.exe RegSvcs.exe PID 1988 wrote to memory of 4116 1988 setspn.exe RegSvcs.exe PID 1988 wrote to memory of 1812 1988 setspn.exe schtasks.exe PID 1988 wrote to memory of 1812 1988 setspn.exe schtasks.exe PID 1988 wrote to memory of 1812 1988 setspn.exe schtasks.exe PID 244 wrote to memory of 5028 244 setspn.exe RegSvcs.exe PID 244 wrote to memory of 5028 244 setspn.exe RegSvcs.exe PID 244 wrote to memory of 5028 244 setspn.exe RegSvcs.exe PID 244 wrote to memory of 5028 244 setspn.exe RegSvcs.exe PID 244 wrote to memory of 5028 244 setspn.exe RegSvcs.exe PID 244 wrote to memory of 4504 244 setspn.exe schtasks.exe PID 244 wrote to memory of 4504 244 setspn.exe schtasks.exe PID 244 wrote to memory of 4504 244 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe"C:\Users\Admin\AppData\Local\Temp\f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.logFilesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5120c39a053f68266c4942ea0ae8c4386
SHA1bd7dae156d8d163a20af665935fcf572a1efd532
SHA25635e2ba0508b0218cf49a33cbd9d7272078a8732333bf550dfa135b8ace50f0c1
SHA512ac3d9a0aed1c39d8061ab410d13115cec3984d7f44c53bd892670430c64a83b5624a521dd0553460bfe4cdd743e7ab6236a6df66e6caa2729b092b197a4e337c
-
memory/244-47-0x0000000000C70000-0x0000000000F1A000-memory.dmpFilesize
2.7MB
-
memory/1872-34-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/1872-32-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/1872-31-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/1872-25-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1988-36-0x0000000000C70000-0x0000000000F1A000-memory.dmpFilesize
2.7MB
-
memory/2016-22-0x0000000000C70000-0x0000000000F1A000-memory.dmpFilesize
2.7MB
-
memory/3676-12-0x0000000005030000-0x00000000050C2000-memory.dmpFilesize
584KB
-
memory/3676-10-0x0000000004EB0000-0x0000000004F0C000-memory.dmpFilesize
368KB
-
memory/3676-17-0x0000000005510000-0x0000000005528000-memory.dmpFilesize
96KB
-
memory/3676-18-0x0000000005E60000-0x0000000006022000-memory.dmpFilesize
1.8MB
-
memory/3676-19-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB
-
memory/3676-20-0x0000000006170000-0x000000000617A000-memory.dmpFilesize
40KB
-
memory/3676-15-0x00000000054E0000-0x00000000054F2000-memory.dmpFilesize
72KB
-
memory/3676-2-0x00000000007A0000-0x000000000088A000-memory.dmpFilesize
936KB
-
memory/3676-24-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3676-11-0x00000000055E0000-0x0000000005B84000-memory.dmpFilesize
5.6MB
-
memory/3676-30-0x0000000002A30000-0x0000000002A40000-memory.dmpFilesize
64KB
-
memory/3676-16-0x00000000054F0000-0x00000000054F8000-memory.dmpFilesize
32KB
-
memory/3676-9-0x0000000000F00000-0x0000000000F0E000-memory.dmpFilesize
56KB
-
memory/3676-8-0x0000000002A30000-0x0000000002A40000-memory.dmpFilesize
64KB
-
memory/3676-7-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4116-37-0x0000000000500000-0x00000000005EA000-memory.dmpFilesize
936KB
-
memory/4116-44-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/4116-43-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4116-45-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4896-0-0x0000000000CD0000-0x0000000000F7A000-memory.dmpFilesize
2.7MB
-
memory/4896-1-0x0000000001830000-0x0000000001831000-memory.dmpFilesize
4KB
-
memory/5028-54-0x0000000005A90000-0x0000000005AA0000-memory.dmpFilesize
64KB
-
memory/5028-53-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/5028-55-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB