Analysis
-
max time kernel
50s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Orbit.exe
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Orbit.exe
Resource
win10v2004-20240426-en
10 signatures
150 seconds
General
-
Target
Orbit.exe
-
Size
8.1MB
-
MD5
e340071c8d67dc28ac37891829293bee
-
SHA1
9e2e1a3df0d69ce2553dbe92a2ca7f361ef90b97
-
SHA256
e0724bdad96e96e0b3cc0f23b4f02359015a9fba4d1ac3ec8bbd71d0b938f9fc
-
SHA512
7c432701ae9c00977bb121539b18f556e82fee2f6f50b19cbe3b17992761399d81fb8a0ccbd893456a2b49a6d6c78edfffda7b1b2e9e76305659019ae8fcb46f
-
SSDEEP
196608:4j1UUL2OM8Wb0guhegLM2GFxpBkSIZ7YW:m1/2OM8hegLMTpBkSY7Y
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Program crash 1 IoCs
pid pid_target Process procid_target 1916 2168 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2168 Orbit.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 1916 2168 Orbit.exe 28 PID 2168 wrote to memory of 1916 2168 Orbit.exe 28 PID 2168 wrote to memory of 1916 2168 Orbit.exe 28 PID 2168 wrote to memory of 1916 2168 Orbit.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orbit.exe"C:\Users\Admin\AppData\Local\Temp\Orbit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 14642⤵
- Program crash
PID:1916
-