Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 16:02

General

  • Target

    Byfron Ultimatum.exe

  • Size

    911KB

  • MD5

    4cbff1c9dfc88532ca3a71e9ee75e699

  • SHA1

    c277d547a809531bc73b5b0f18d48c6ebc109709

  • SHA256

    0eb38d225cb51a781634e4285262599b87c5829c63f6bce50062db64ef8cf39c

  • SHA512

    b5baba36db1f3a88c0644adf4df723b61059ad0c68b3b657b753ab6e01db85948c6c22b3dab649c828da76cf6711303f9ac6853663b28575974ec6af63a5a3cd

  • SSDEEP

    24576:gk84MROxnFj3wBukhrrcI0AilFEvxHPJooCp:giMi1ZqrrcI0AilFEvxHPK

Malware Config

Extracted

Family

orcus

Botnet

Niggers

C2

should-nutritional.gl.at.ply.gg:22817

Mutex

721eca8ad3474c2ab1c30e76379e1f7d

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\temp\conhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Microsoft

  • taskscheduler_taskname

    winhost

  • watchdog_path

    Temp\wininit.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Byfron Ultimatum.exe
    "C:\Users\Admin\AppData\Local\Temp\Byfron Ultimatum.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Program Files (x86)\temp\conhost.exe
      "C:\Program Files (x86)\temp\conhost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Users\Admin\AppData\Local\Temp\wininit.exe
        "C:\Users\Admin\AppData\Local\Temp\wininit.exe" /launchSelfAndExit "C:\Program Files (x86)\temp\conhost.exe" 4952 /protectFile
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Users\Admin\AppData\Local\Temp\wininit.exe
          "C:\Users\Admin\AppData\Local\Temp\wininit.exe" /watchProcess "C:\Program Files (x86)\temp\conhost.exe" 4952 "/protectFile"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:436
  • C:\Program Files (x86)\temp\conhost.exe
    "C:\Program Files (x86)\temp\conhost.exe"
    1⤵
    • Executes dropped EXE
    PID:452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\temp\conhost.exe

    Filesize

    911KB

    MD5

    4cbff1c9dfc88532ca3a71e9ee75e699

    SHA1

    c277d547a809531bc73b5b0f18d48c6ebc109709

    SHA256

    0eb38d225cb51a781634e4285262599b87c5829c63f6bce50062db64ef8cf39c

    SHA512

    b5baba36db1f3a88c0644adf4df723b61059ad0c68b3b657b753ab6e01db85948c6c22b3dab649c828da76cf6711303f9ac6853663b28575974ec6af63a5a3cd

  • C:\Program Files (x86)\temp\conhost.exe.config

    Filesize

    357B

    MD5

    a2b76cea3a59fa9af5ea21ff68139c98

    SHA1

    35d76475e6a54c168f536e30206578babff58274

    SHA256

    f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

    SHA512

    b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wininit.exe.log

    Filesize

    425B

    MD5

    4eaca4566b22b01cd3bc115b9b0b2196

    SHA1

    e743e0792c19f71740416e7b3c061d9f1336bf94

    SHA256

    34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

    SHA512

    bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

  • C:\Users\Admin\AppData\Local\Temp\wininit.exe

    Filesize

    9KB

    MD5

    913967b216326e36a08010fb70f9dba3

    SHA1

    7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

    SHA256

    8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

    SHA512

    c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\AForge.Video.DirectShow.dll

    Filesize

    60KB

    MD5

    17ed442e8485ac3f7dc5b3c089654a61

    SHA1

    d3a17c1fdd6d54951141053f88bf8238dea0b937

    SHA256

    666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b

    SHA512

    9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\AForge.Video.dll

    Filesize

    20KB

    MD5

    0bd34aa29c7ea4181900797395a6da78

    SHA1

    ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8

    SHA256

    bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d

    SHA512

    a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\SharpDX.DXGI.dll

    Filesize

    125KB

    MD5

    2b44c70c49b70d797fbb748158b5d9bb

    SHA1

    93e00e6527e461c45c7868d14cf05c007e478081

    SHA256

    3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf

    SHA512

    faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\SharpDX.Direct3D11.dll

    Filesize

    271KB

    MD5

    98eb5ba5871acdeaebf3a3b0f64be449

    SHA1

    c965284f60ef789b00b10b3df60ee682b4497de3

    SHA256

    d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c

    SHA512

    a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\SharpDX.Direct3D9.dll

    Filesize

    338KB

    MD5

    934da0e49208d0881c44fe19d5033840

    SHA1

    a19c5a822e82e41752a08d3bd9110db19a8a5016

    SHA256

    02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7

    SHA512

    de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\SharpDX.dll

    Filesize

    247KB

    MD5

    ffb4b61cc11bec6d48226027c2c26704

    SHA1

    fa8b9e344accbdc4dffa9b5d821d23f0716da29e

    SHA256

    061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303

    SHA512

    48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9

  • C:\Users\Admin\AppData\Roaming\Orcus\lib_721eca8ad3474c2ab1c30e76379e1f7d\TurboJpegWrapper.dll

    Filesize

    1.3MB

    MD5

    ac6acc235ebef6374bed71b37e322874

    SHA1

    a267baad59cd7352167636836bad4b971fcd6b6b

    SHA256

    047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96

    SHA512

    72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081

  • memory/452-63-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/452-36-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/452-33-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-4-0x00000000058F0000-0x000000000594C000-memory.dmp

    Filesize

    368KB

  • memory/1636-6-0x0000000005A80000-0x0000000005B12000-memory.dmp

    Filesize

    584KB

  • memory/1636-0-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

  • memory/1636-3-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-7-0x0000000005F20000-0x0000000005F32000-memory.dmp

    Filesize

    72KB

  • memory/1636-5-0x0000000006030000-0x00000000065D4000-memory.dmp

    Filesize

    5.6MB

  • memory/1636-8-0x0000000005FB0000-0x0000000005FBA000-memory.dmp

    Filesize

    40KB

  • memory/1636-2-0x0000000003200000-0x000000000320E000-memory.dmp

    Filesize

    56KB

  • memory/1636-1-0x0000000000E60000-0x0000000000F48000-memory.dmp

    Filesize

    928KB

  • memory/1636-26-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/3944-52-0x0000000000280000-0x0000000000288000-memory.dmp

    Filesize

    32KB

  • memory/4952-58-0x0000000007A70000-0x0000000007A82000-memory.dmp

    Filesize

    72KB

  • memory/4952-91-0x00000000016F0000-0x0000000001716000-memory.dmp

    Filesize

    152KB

  • memory/4952-59-0x0000000007E80000-0x0000000007EBC000-memory.dmp

    Filesize

    240KB

  • memory/4952-60-0x0000000007EC0000-0x0000000007F0C000-memory.dmp

    Filesize

    304KB

  • memory/4952-61-0x0000000008020000-0x000000000812A000-memory.dmp

    Filesize

    1.0MB

  • memory/4952-56-0x0000000007570000-0x00000000075D6000-memory.dmp

    Filesize

    408KB

  • memory/4952-64-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4952-65-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4952-35-0x0000000006AF0000-0x0000000006CB2000-memory.dmp

    Filesize

    1.8MB

  • memory/4952-70-0x0000000001740000-0x0000000001784000-memory.dmp

    Filesize

    272KB

  • memory/4952-34-0x0000000006910000-0x0000000006920000-memory.dmp

    Filesize

    64KB

  • memory/4952-77-0x0000000001790000-0x00000000017DA000-memory.dmp

    Filesize

    296KB

  • memory/4952-31-0x0000000006080000-0x0000000006098000-memory.dmp

    Filesize

    96KB

  • memory/4952-84-0x00000000067C0000-0x000000000681A000-memory.dmp

    Filesize

    360KB

  • memory/4952-30-0x0000000006020000-0x0000000006038000-memory.dmp

    Filesize

    96KB

  • memory/4952-57-0x0000000008460000-0x0000000008A78000-memory.dmp

    Filesize

    6.1MB

  • memory/4952-29-0x0000000005F90000-0x0000000005FDE000-memory.dmp

    Filesize

    312KB

  • memory/4952-98-0x0000000008A80000-0x0000000008BD4000-memory.dmp

    Filesize

    1.3MB

  • memory/4952-106-0x0000000008D30000-0x0000000008D3C000-memory.dmp

    Filesize

    48KB

  • memory/4952-28-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4952-109-0x0000000040000000-0x000000004043E000-memory.dmp

    Filesize

    4.2MB

  • memory/4952-117-0x0000000040000000-0x000000004049D000-memory.dmp

    Filesize

    4.6MB

  • memory/4952-127-0x0000000040000000-0x000000004034B000-memory.dmp

    Filesize

    3.3MB

  • memory/4952-137-0x00000000099A0000-0x00000000099B6000-memory.dmp

    Filesize

    88KB

  • memory/4952-27-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

  • memory/4952-122-0x0000000040000000-0x00000000400C3000-memory.dmp

    Filesize

    780KB

  • memory/4952-140-0x0000000040000000-0x0000000040A99000-memory.dmp

    Filesize

    10.6MB

  • memory/4952-146-0x0000000040000000-0x0000000040007000-memory.dmp

    Filesize

    28KB

  • memory/4952-162-0x0000000040000000-0x0000000040047000-memory.dmp

    Filesize

    284KB

  • memory/4952-152-0x0000000040000000-0x0000000040032000-memory.dmp

    Filesize

    200KB