Analysis
-
max time kernel
27s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21-05-2024 01:11
Errors
General
-
Target
7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe
-
Size
15.0MB
-
MD5
c9a729181d000d53b390da89f4d68d0c
-
SHA1
b1ba9b1e69634202f596c31bd69d975f3ddf5298
-
SHA256
7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c
-
SHA512
04bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a
-
SSDEEP
24576:1Zf4MROxnFaarrcI0AilFEvxHPG+qoot:1WMi5rrcI0AilFEvxHP
Malware Config
Extracted
orcus
CC
192.168.1.5:10134
a9b4352a71bc43b0b7d8d88b859bf9a8
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\system\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
registy
-
taskscheduler_taskname
wsappx
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe"C:\Users\Admin\AppData\Local\Temp\7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4252,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.0MB
MD5c9a729181d000d53b390da89f4d68d0c
SHA1b1ba9b1e69634202f596c31bd69d975f3ddf5298
SHA2567a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c
SHA51204bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a
-
Filesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
240KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB
-
Filesize
176KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
368KB
-
Filesize
56KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
568KB
-
Filesize
952KB
-
Filesize
712KB
-
Filesize
2.1MB
-
Filesize
288KB
-
Filesize
56KB
-
Filesize
4.1MB
-
Filesize
23.5MB
-
Filesize
10.6MB
-
Filesize
736KB
-
Filesize
1.5MB
-
Filesize
396KB
-
Filesize
528KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
192KB
-
Filesize
464KB
-
Filesize
128KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
592KB
-
Filesize
968KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
152KB
-
Filesize
256KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
144KB
-
Filesize
56KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
160KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
160KB
-
Filesize
136KB
-
Filesize
112KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
160KB
-
Filesize
152KB
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB