Analysis
-
max time kernel
90s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
31-05-2024 01:47
General
-
Target
8a84df75a293de90b0afab38e0cdd128741bd974e4721d758b6a313466c2360e.exe
-
Size
893KB
-
MD5
94aaf96130087168fd841b7d1b6d1033
-
SHA1
075a59258f1b501b2f44e800a16f676b368fb30d
-
SHA256
8a84df75a293de90b0afab38e0cdd128741bd974e4721d758b6a313466c2360e
-
SHA512
31d614b2e1fb50289b9ac7e283422b7700c9875606d8d6fbe870f46e5627f7cca9a37b30084158fd39ed10a00ffff549b1e0d96619c414ea11d9b53f4e6fbd5e
-
SSDEEP
12288:1NmZ8wcD2K5hxdG1lFlWcYr70RxnnaaoaMx9C6VJudQBznRFfhIKw7I/i2JFRw:1gawcR4Mp+xnFyvy+nRFfhIK8I/i2JU
Malware Config
Extracted
orcus
93.157.168.72:27667
b3f6c529cb2c49bea14b8c2b795de50a
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Vape\Client.exe
-
reconnect_delay
10000
-
registry_keyname
GoogleChrome
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a84df75a293de90b0afab38e0cdd128741bd974e4721d758b6a313466c2360e.exe"C:\Users\Admin\AppData\Local\Temp\8a84df75a293de90b0afab38e0cdd128741bd974e4721d758b6a313466c2360e.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Vape\Client.exe"C:\Program Files\Vape\Client.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893KB
MD594aaf96130087168fd841b7d1b6d1033
SHA1075a59258f1b501b2f44e800a16f676b368fb30d
SHA2568a84df75a293de90b0afab38e0cdd128741bd974e4721d758b6a313466c2360e
SHA51231d614b2e1fb50289b9ac7e283422b7700c9875606d8d6fbe870f46e5627f7cca9a37b30084158fd39ed10a00ffff549b1e0d96619c414ea11d9b53f4e6fbd5e
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
8KB
-
Filesize
920KB
-
Filesize
368KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
312KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB