Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
21-05-2024 01:11
General
-
Target
7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe
-
Size
15.0MB
-
MD5
c9a729181d000d53b390da89f4d68d0c
-
SHA1
b1ba9b1e69634202f596c31bd69d975f3ddf5298
-
SHA256
7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c
-
SHA512
04bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a
-
SSDEEP
24576:1Zf4MROxnFaarrcI0AilFEvxHPG+qoot:1WMi5rrcI0AilFEvxHP
Malware Config
Extracted
orcus
CC
192.168.1.5:10134
a9b4352a71bc43b0b7d8d88b859bf9a8
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\system\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
registy
-
taskscheduler_taskname
wsappx
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 4 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe"C:\Users\Admin\AppData\Local\Temp\7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Program Files (x86)\system\Orcus.exe"C:\Program Files (x86)\system\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {DFF34905-F2FD-4DCE-AE56-B299FB5B44CB} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\system\Orcus.exe"C:\Program Files (x86)\system\Orcus.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
15.0MB
MD5c9a729181d000d53b390da89f4d68d0c
SHA1b1ba9b1e69634202f596c31bd69d975f3ddf5298
SHA2567a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c
SHA51204bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a
-
Filesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
152KB
-
Filesize
120KB
-
Filesize
160KB
-
Filesize
568KB
-
Filesize
952KB
-
Filesize
712KB
-
Filesize
208KB
-
Filesize
920KB
-
Filesize
408KB
-
Filesize
388KB
-
Filesize
1.5MB
-
Filesize
688KB
-
Filesize
32KB
-
Filesize
400KB
-
Filesize
132KB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
152KB
-
Filesize
96KB
-
Filesize
236KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
152KB
-
Filesize
112KB
-
Filesize
1.0MB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
152KB
-
Filesize
492KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
816KB
-
Filesize
364KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
368KB
-
Filesize
228KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
852KB
-
Filesize
160KB
-
Filesize
152KB
-
Filesize
128KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
176KB
-
Filesize
80KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
120KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
852KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
48KB
-
Filesize
4KB