orcus | a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe
Size

903KB
MD5

5d29b913273c7abfc589ee8c620f12f6
SHA1

36369b0f2ccc7b50720ed21d607166fac13d6e3a
SHA256

a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62
SHA512

be0862868f343f394d7597a365aed628a8e71eb4d419196b5a08e5af2065f39b8b0449e56961b2c59fa66d7c497ab2b5f9afab75f1a0a7c275304ab1912183a1
SSDEEP

12288:b0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCZ3uljipeyKWepvBgw7dG1lFlWz:EW64MROxnFgHrrcI0AilFEvxHPX9ood

Score

10^/10

orcus rat spyware stealer

Malware Config

Extracted

Family

orcus

91.109.186.2:1194

Mutex

60d5f56e0ff9486480153dc7e98d1c84

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral2/memory/2972-1-0x0000000000EB0000-0x0000000000F98000-memory.dmp	orcus

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2972	a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe

C:\Users\Admin\AppData\Local\Temp\a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe
"C:\Users\Admin\AppData\Local\Temp\a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972

C:\Users\Admin\AppData\Local\Temp\a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe
C:\Users\Admin\AppData\Local\Temp\a57055364481676e2cf162f4f91be228458c7e03eed0f54d1e5f18a8907a3b62.exe
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
1⤵
PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-8-0x0000000006580000-0x00000000065CE000-memory.dmp

Filesize
312KB

Download
memory/2972-2-0x0000000003350000-0x000000000335E000-memory.dmp

Filesize
56KB

Download
memory/2972-9-0x00000000067A0000-0x00000000067B8000-memory.dmp

Filesize
96KB

Download
memory/2972-10-0x0000000006B10000-0x0000000006CD2000-memory.dmp

Filesize
1.8MB

Download
memory/2972-4-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2972-5-0x0000000005FD0000-0x0000000006574000-memory.dmp

Filesize
5.6MB

Download
memory/2972-6-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/2972-7-0x0000000005FB0000-0x0000000005FC2000-memory.dmp

Filesize
72KB

Download
memory/2972-18-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2972-1-0x0000000000EB0000-0x0000000000F98000-memory.dmp

Filesize
928KB

Download
memory/2972-3-0x0000000005940000-0x000000000599C000-memory.dmp

Filesize
368KB

Download
memory/2972-11-0x0000000006920000-0x0000000006930000-memory.dmp

Filesize
64KB

Download
memory/2972-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/2972-17-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/2972-14-0x0000000006D10000-0x0000000006D1A000-memory.dmp

Filesize
40KB

Download
memory/4860-16-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/4860-13-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/4860-12-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download