Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 03:06
Static task
static1
Behavioral task
behavioral1
Sample
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe
Resource
win7-20240220-en
General
-
Target
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe
-
Size
2.6MB
-
MD5
5ffbae338230732fe997c692b42f199e
-
SHA1
da5678c3a66e183b6436b6452aa4fbbfe28872f0
-
SHA256
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae
-
SHA512
ffb7e1870927cbef809a5777384a395be4bfa2b2359b30570e2bb55a994df0b087ccea7fb9f50bff358e3176ef3ba5e9dc398b70d1a22d1e27e0782fdf8b1587
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxv:Hh+ZkldoPKiYdqd6X
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1496-2-0x0000000000400000-0x00000000004EA000-memory.dmp orcus -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setspn.exesetspn.exesetspn.exe162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation setspn.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe -
Executes dropped EXE 3 IoCs
Processes:
setspn.exesetspn.exesetspn.exepid process 4360 setspn.exe 1436 setspn.exe 2528 setspn.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4468-0-0x00000000005A0000-0x000000000084A000-memory.dmp autoit_exe C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe autoit_exe behavioral2/memory/4360-22-0x0000000000C40000-0x0000000000EEA000-memory.dmp autoit_exe behavioral2/memory/1436-36-0x0000000000C40000-0x0000000000EEA000-memory.dmp autoit_exe behavioral2/memory/2528-47-0x0000000000C40000-0x0000000000EEA000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4468 set thread context of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4360 set thread context of 1844 4360 setspn.exe RegSvcs.exe PID 1436 set thread context of 4192 1436 setspn.exe RegSvcs.exe PID 2528 set thread context of 2288 2528 setspn.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3268 schtasks.exe 4332 schtasks.exe 5040 schtasks.exe 1224 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exesetspn.exesetspn.exesetspn.exepid process 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe 4360 setspn.exe 4360 setspn.exe 4360 setspn.exe 4360 setspn.exe 1436 setspn.exe 1436 setspn.exe 1436 setspn.exe 1436 setspn.exe 2528 setspn.exe 2528 setspn.exe 2528 setspn.exe 2528 setspn.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 1496 RegSvcs.exe Token: SeManageVolumePrivilege 1436 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1496 RegSvcs.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exesetspn.exesetspn.exesetspn.exedescription pid process target process PID 4468 wrote to memory of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4468 wrote to memory of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4468 wrote to memory of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4468 wrote to memory of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4468 wrote to memory of 1496 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe RegSvcs.exe PID 4468 wrote to memory of 3268 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe schtasks.exe PID 4468 wrote to memory of 3268 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe schtasks.exe PID 4468 wrote to memory of 3268 4468 162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe schtasks.exe PID 4360 wrote to memory of 1844 4360 setspn.exe RegSvcs.exe PID 4360 wrote to memory of 1844 4360 setspn.exe RegSvcs.exe PID 4360 wrote to memory of 1844 4360 setspn.exe RegSvcs.exe PID 4360 wrote to memory of 1844 4360 setspn.exe RegSvcs.exe PID 4360 wrote to memory of 1844 4360 setspn.exe RegSvcs.exe PID 4360 wrote to memory of 4332 4360 setspn.exe schtasks.exe PID 4360 wrote to memory of 4332 4360 setspn.exe schtasks.exe PID 4360 wrote to memory of 4332 4360 setspn.exe schtasks.exe PID 1436 wrote to memory of 4192 1436 setspn.exe RegSvcs.exe PID 1436 wrote to memory of 4192 1436 setspn.exe RegSvcs.exe PID 1436 wrote to memory of 4192 1436 setspn.exe RegSvcs.exe PID 1436 wrote to memory of 4192 1436 setspn.exe RegSvcs.exe PID 1436 wrote to memory of 4192 1436 setspn.exe RegSvcs.exe PID 1436 wrote to memory of 5040 1436 setspn.exe schtasks.exe PID 1436 wrote to memory of 5040 1436 setspn.exe schtasks.exe PID 1436 wrote to memory of 5040 1436 setspn.exe schtasks.exe PID 2528 wrote to memory of 2288 2528 setspn.exe RegSvcs.exe PID 2528 wrote to memory of 2288 2528 setspn.exe RegSvcs.exe PID 2528 wrote to memory of 2288 2528 setspn.exe RegSvcs.exe PID 2528 wrote to memory of 2288 2528 setspn.exe RegSvcs.exe PID 2528 wrote to memory of 2288 2528 setspn.exe RegSvcs.exe PID 2528 wrote to memory of 1224 2528 setspn.exe schtasks.exe PID 2528 wrote to memory of 1224 2528 setspn.exe schtasks.exe PID 2528 wrote to memory of 1224 2528 setspn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe"C:\Users\Admin\AppData\Local\Temp\162c394ce267719610b0a9594d7f4f163e8539236d0af4b1eb1ce3705eeb58ae.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeC:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn sfc /tr "C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.logFilesize
1KB
MD50672db2ef13237d5cb85075ff4915942
SHA1ad8b4d3eb5e40791c47d48b22e273486f25f663f
SHA2560a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519
SHA51284ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b
-
C:\Users\Admin\AppData\Roaming\coredpussvr\setspn.exeFilesize
2.6MB
MD57e2bbcd9e0bd224714ab240ac0c8f18a
SHA1a2e45f583005bc7b80406de5898a4395a3bec29d
SHA25693d52ac21fea3847429676ad8e87cd74e04d8dfa72ced9ad4717c6c17a365083
SHA51201ee8496d0813edb24be54c11eeac0cbeefe0d11c408ff244f41d25c99fab59a210969505fc6b11ec3d9f55b174b6a707801dc90806fd00f4365c71b2c31339f
-
memory/1436-84-0x00000241175A0000-0x00000241175A1000-memory.dmpFilesize
4KB
-
memory/1436-36-0x0000000000C40000-0x0000000000EEA000-memory.dmpFilesize
2.7MB
-
memory/1436-64-0x000002410F140000-0x000002410F150000-memory.dmpFilesize
64KB
-
memory/1436-80-0x0000024117460000-0x0000024117461000-memory.dmpFilesize
4KB
-
memory/1436-82-0x0000024117490000-0x0000024117491000-memory.dmpFilesize
4KB
-
memory/1436-83-0x0000024117490000-0x0000024117491000-memory.dmpFilesize
4KB
-
memory/1496-9-0x00000000055A0000-0x00000000055AE000-memory.dmpFilesize
56KB
-
memory/1496-13-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/1496-16-0x0000000005750000-0x0000000005758000-memory.dmpFilesize
32KB
-
memory/1496-17-0x0000000005B90000-0x0000000005BA8000-memory.dmpFilesize
96KB
-
memory/1496-18-0x00000000065C0000-0x0000000006782000-memory.dmpFilesize
1.8MB
-
memory/1496-19-0x0000000005BE0000-0x0000000005BF0000-memory.dmpFilesize
64KB
-
memory/1496-20-0x00000000065A0000-0x00000000065AA000-memory.dmpFilesize
40KB
-
memory/1496-15-0x0000000005740000-0x0000000005752000-memory.dmpFilesize
72KB
-
memory/1496-11-0x0000000005BF0000-0x0000000006194000-memory.dmpFilesize
5.6MB
-
memory/1496-10-0x00000000055D0000-0x000000000562C000-memory.dmpFilesize
368KB
-
memory/1496-8-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/1496-7-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/1496-33-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/1496-34-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/1496-2-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1844-29-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/1844-32-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/1844-30-0x0000000003330000-0x0000000003340000-memory.dmpFilesize
64KB
-
memory/2288-90-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/2288-91-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/2288-92-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/2528-47-0x0000000000C40000-0x0000000000EEA000-memory.dmpFilesize
2.7MB
-
memory/4192-43-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/4192-44-0x0000000002990000-0x00000000029A0000-memory.dmpFilesize
64KB
-
memory/4192-45-0x0000000073F10000-0x00000000746C0000-memory.dmpFilesize
7.7MB
-
memory/4360-22-0x0000000000C40000-0x0000000000EEA000-memory.dmpFilesize
2.7MB
-
memory/4468-0-0x00000000005A0000-0x000000000084A000-memory.dmpFilesize
2.7MB
-
memory/4468-1-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB