Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe
Resource
win7-20240221-en
General
-
Target
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe
-
Size
2.6MB
-
MD5
30e6c469c3a8bab115b69f45a6cedaf4
-
SHA1
0e41e9e0026a75cbad35b954a53e16b8520182e5
-
SHA256
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda
-
SHA512
f13de2ed7d11874092b4f3d604347a7836d676a264f89cd4eb4586c55349c4739ccfdfa96eba78dafef169ddc9d266b21896c0b92543676178ca2adf389f0362
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxk:Hh+ZkldoPKiYdqd6M
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-3-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1628-9-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/1628-10-0x0000000000400000-0x00000000004EA000-memory.dmp orcus behavioral1/memory/2920-40-0x0000000000200000-0x00000000002EA000-memory.dmp orcus behavioral1/memory/2920-46-0x0000000000200000-0x00000000002EA000-memory.dmp orcus behavioral1/memory/2920-47-0x0000000000200000-0x00000000002EA000-memory.dmp orcus -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 2448 setspn.exe 1580 setspn.exe 1648 setspn.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2992-0-0x0000000000890000-0x0000000000B3A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral1/memory/2448-23-0x0000000001370000-0x000000000161A000-memory.dmp autoit_exe behavioral1/memory/1580-38-0x0000000001370000-0x000000000161A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2992 set thread context of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2448 set thread context of 2932 2448 setspn.exe RegSvcs.exe PID 1580 set thread context of 2920 1580 setspn.exe RegSvcs.exe PID 1648 set thread context of 1484 1648 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2372 schtasks.exe 2080 schtasks.exe 1724 schtasks.exe 2520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exesetspn.exesetspn.exesetspn.exepid process 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe 2448 setspn.exe 2448 setspn.exe 1580 setspn.exe 1580 setspn.exe 1648 setspn.exe 1648 setspn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1628 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1628 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exetaskeng.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 1628 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe RegSvcs.exe PID 2992 wrote to memory of 2520 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe schtasks.exe PID 2992 wrote to memory of 2520 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe schtasks.exe PID 2992 wrote to memory of 2520 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe schtasks.exe PID 2992 wrote to memory of 2520 2992 055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe schtasks.exe PID 2552 wrote to memory of 2448 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 2448 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 2448 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 2448 2552 taskeng.exe setspn.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2932 2448 setspn.exe RegSvcs.exe PID 2448 wrote to memory of 2372 2448 setspn.exe schtasks.exe PID 2448 wrote to memory of 2372 2448 setspn.exe schtasks.exe PID 2448 wrote to memory of 2372 2448 setspn.exe schtasks.exe PID 2448 wrote to memory of 2372 2448 setspn.exe schtasks.exe PID 2552 wrote to memory of 1580 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1580 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1580 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1580 2552 taskeng.exe setspn.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2920 1580 setspn.exe RegSvcs.exe PID 1580 wrote to memory of 2080 1580 setspn.exe schtasks.exe PID 1580 wrote to memory of 2080 1580 setspn.exe schtasks.exe PID 1580 wrote to memory of 2080 1580 setspn.exe schtasks.exe PID 1580 wrote to memory of 2080 1580 setspn.exe schtasks.exe PID 2552 wrote to memory of 1648 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1648 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1648 2552 taskeng.exe setspn.exe PID 2552 wrote to memory of 1648 2552 taskeng.exe setspn.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1484 1648 setspn.exe RegSvcs.exe PID 1648 wrote to memory of 1724 1648 setspn.exe schtasks.exe PID 1648 wrote to memory of 1724 1648 setspn.exe schtasks.exe PID 1648 wrote to memory of 1724 1648 setspn.exe schtasks.exe PID 1648 wrote to memory of 1724 1648 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe"C:\Users\Admin\AppData\Local\Temp\055e00837c9cf904b584196df08e5391045ba52e4f876f136ce13e5f0a909eda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {D805DFB3-C763-4CA8-9124-5AF492C2BE81} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD5a3a26d63f6e3979ef6efeac8fcd7a9e4
SHA1644567d01aad86854dbcc6ef1950be6d2f16df57
SHA256fa6f46f6a23fa65aa814e1ba940806a2c5312fc06ea08a284b4d544cc3a87c19
SHA512e9d0578fed802975fd22a97bec0e560ec116f270e6de9d0ac83153d1d0c2c29d16f9d0ac471510e8722afb3af5bbf351ddd586fcedb4799d47709a28f830dc54
-
memory/1484-64-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/1484-63-0x0000000004D20000-0x0000000004D60000-memory.dmpFilesize
256KB
-
memory/1484-62-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/1580-38-0x0000000001370000-0x000000000161A000-memory.dmpFilesize
2.7MB
-
memory/1628-14-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/1628-28-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1628-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1628-13-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/1628-15-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1628-16-0x0000000002180000-0x00000000021DC000-memory.dmpFilesize
368KB
-
memory/1628-17-0x0000000000620000-0x0000000000632000-memory.dmpFilesize
72KB
-
memory/1628-18-0x0000000000640000-0x0000000000648000-memory.dmpFilesize
32KB
-
memory/1628-19-0x0000000000650000-0x0000000000668000-memory.dmpFilesize
96KB
-
memory/1628-20-0x0000000000880000-0x0000000000890000-memory.dmpFilesize
64KB
-
memory/1628-9-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1628-3-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1628-24-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/1628-10-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1628-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2448-23-0x0000000001370000-0x000000000161A000-memory.dmpFilesize
2.7MB
-
memory/2920-40-0x0000000000200000-0x00000000002EA000-memory.dmpFilesize
936KB
-
memory/2920-46-0x0000000000200000-0x00000000002EA000-memory.dmpFilesize
936KB
-
memory/2920-47-0x0000000000200000-0x00000000002EA000-memory.dmpFilesize
936KB
-
memory/2920-48-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/2920-49-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/2920-50-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/2932-36-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/2932-35-0x00000000743A0000-0x0000000074A8E000-memory.dmpFilesize
6.9MB
-
memory/2992-0-0x0000000000890000-0x0000000000B3A000-memory.dmpFilesize
2.7MB
-
memory/2992-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB