Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:46
Behavioral task
behavioral1
Sample
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe
Resource
win10v2004-20240508-en
General
-
Target
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe
-
Size
944KB
-
MD5
5b2b363429b9a05c302a472918f7a11c
-
SHA1
487eb2ba20779fe2b80932c2c1f0192a2643a17e
-
SHA256
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e
-
SHA512
3868dc59c0a8cac98d0f9f075ff6d0d457fde42f9aa50c7fead2fadf4c83fdfac9da70883354dee3039f0f64c392c2d5cb107d4bc809d59cb4bd81d9bf330976
-
SSDEEP
24576:jGRs4MROxnFi36sVrrcI0AilFEvxHPYooh:jM/Mio7VrrcI0AilFEvxHP
Malware Config
Extracted
orcus
Tanin Komp
192.168.200.18:10134
e8facf65797c47f380e8502c73b84cf9
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
<inecraft server administration tools
-
watchdog_path
Temp\Minecraft server tools tasker.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Orcus\Orcus.exe family_orcus -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1324-1-0x00000000009E0000-0x0000000000AD2000-memory.dmp orcus C:\Program Files (x86)\Orcus\Orcus.exe orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exeOrcus.exeMinecraft server tools tasker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Orcus.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Minecraft server tools tasker.exe -
Executes dropped EXE 3 IoCs
Processes:
Orcus.exeMinecraft server tools tasker.exeMinecraft server tools tasker.exepid process 2680 Orcus.exe 4352 Minecraft server tools tasker.exe 3260 Minecraft server tools tasker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Orcus.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Orcus = "\"C:\\Program Files (x86)\\Orcus\\Orcus.exe\"" Orcus.exe -
Drops file in Program Files directory 3 IoCs
Processes:
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exedescription ioc process File created C:\Program Files (x86)\Orcus\Orcus.exe b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Orcus.exeMinecraft server tools tasker.exepid process 2680 Orcus.exe 2680 Orcus.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 3260 Minecraft server tools tasker.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe 2680 Orcus.exe 3260 Minecraft server tools tasker.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Orcus.exeMinecraft server tools tasker.exeMinecraft server tools tasker.exedescription pid process Token: SeDebugPrivilege 2680 Orcus.exe Token: SeDebugPrivilege 4352 Minecraft server tools tasker.exe Token: SeDebugPrivilege 3260 Minecraft server tools tasker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Orcus.exepid process 2680 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orcus.exepid process 2680 Orcus.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exeOrcus.exeMinecraft server tools tasker.exedescription pid process target process PID 1324 wrote to memory of 2680 1324 b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe Orcus.exe PID 1324 wrote to memory of 2680 1324 b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe Orcus.exe PID 1324 wrote to memory of 2680 1324 b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe Orcus.exe PID 2680 wrote to memory of 4352 2680 Orcus.exe Minecraft server tools tasker.exe PID 2680 wrote to memory of 4352 2680 Orcus.exe Minecraft server tools tasker.exe PID 2680 wrote to memory of 4352 2680 Orcus.exe Minecraft server tools tasker.exe PID 4352 wrote to memory of 3260 4352 Minecraft server tools tasker.exe Minecraft server tools tasker.exe PID 4352 wrote to memory of 3260 4352 Minecraft server tools tasker.exe Minecraft server tools tasker.exe PID 4352 wrote to memory of 3260 4352 Minecraft server tools tasker.exe Minecraft server tools tasker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe"C:\Users\Admin\AppData\Local\Temp\b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Minecraft server tools tasker.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft server tools tasker.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2680 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Minecraft server tools tasker.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft server tools tasker.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2680 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Orcus\Orcus.exeFilesize
944KB
MD55b2b363429b9a05c302a472918f7a11c
SHA1487eb2ba20779fe2b80932c2c1f0192a2643a17e
SHA256b380702b2efcf3f396879bf8a26a26c49bcaff0653feaf00cd3906e49aeeb02e
SHA5123868dc59c0a8cac98d0f9f075ff6d0d457fde42f9aa50c7fead2fadf4c83fdfac9da70883354dee3039f0f64c392c2d5cb107d4bc809d59cb4bd81d9bf330976
-
C:\Program Files (x86)\Orcus\Orcus.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Minecraft server tools tasker.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\Minecraft server tools tasker.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\Minecraft server tools\err_e8facf65797c47f380e8502c73b84cf9.datFilesize
1KB
MD5306bbb87108a28e840be3a0e541cf365
SHA1eb847c5d83c40eeab25a8c49a160c495a3fdce57
SHA25630511c5d8bc2a9e50fcbcb67c82866de4c2d99bbe24d449c4f4dcc3d6c510046
SHA512a80eab03ed5b3dd98fc1bfafb6f43930a3b552e7bfe002665654bbc42c17d8dc9965946fb49efa9df269a9d41aa9b66317851223dd8979d293ca2d46e5609640
-
memory/1324-8-0x0000000005490000-0x0000000005498000-memory.dmpFilesize
32KB
-
memory/1324-14-0x0000000006180000-0x00000000061CC000-memory.dmpFilesize
304KB
-
memory/1324-7-0x0000000005430000-0x0000000005442000-memory.dmpFilesize
72KB
-
memory/1324-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmpFilesize
4KB
-
memory/1324-9-0x00000000054A0000-0x00000000054A8000-memory.dmpFilesize
32KB
-
memory/1324-10-0x0000000006030000-0x0000000006096000-memory.dmpFilesize
408KB
-
memory/1324-11-0x00000000066C0000-0x0000000006CD8000-memory.dmpFilesize
6.1MB
-
memory/1324-12-0x00000000060E0000-0x00000000060F2000-memory.dmpFilesize
72KB
-
memory/1324-13-0x0000000006140000-0x000000000617C000-memory.dmpFilesize
240KB
-
memory/1324-3-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/1324-15-0x0000000006300000-0x000000000640A000-memory.dmpFilesize
1.0MB
-
memory/1324-5-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/1324-4-0x0000000005320000-0x000000000537C000-memory.dmpFilesize
368KB
-
memory/1324-33-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/1324-1-0x00000000009E0000-0x0000000000AD2000-memory.dmpFilesize
968KB
-
memory/1324-6-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/1324-2-0x0000000002EA0000-0x0000000002EAE000-memory.dmpFilesize
56KB
-
memory/2680-34-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/2680-38-0x0000000006270000-0x00000000062BE000-memory.dmpFilesize
312KB
-
memory/2680-39-0x00000000062C0000-0x00000000062D8000-memory.dmpFilesize
96KB
-
memory/2680-40-0x0000000006AB0000-0x0000000006AC8000-memory.dmpFilesize
96KB
-
memory/2680-41-0x0000000006C30000-0x0000000006C40000-memory.dmpFilesize
64KB
-
memory/2680-42-0x0000000006F90000-0x0000000006F9A000-memory.dmpFilesize
40KB
-
memory/2680-35-0x00000000054C0000-0x00000000054D2000-memory.dmpFilesize
72KB
-
memory/2680-32-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/2680-62-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/2680-63-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/4352-56-0x0000000000190000-0x0000000000198000-memory.dmpFilesize
32KB
-
memory/4352-57-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB
-
memory/4352-61-0x0000000074C60000-0x0000000075410000-memory.dmpFilesize
7.7MB