orcus | 374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
Size

915KB
MD5

5068ade29bf53c33416a18110c7abe26
SHA1

9ac01bd400d816ff2cbe003d1f4a729d6cb20615
SHA256

374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c
SHA512

649630c6b5959cb3e35e707748afda96b9ab21b247a8e5440a9a0c665da4ef030f7d71216b6a05bf99a4d6c86353dfa9a26507ea7a9b356fbdab2d031e93d5e7
SSDEEP

24576:CEqr4MROxnFi3PrkrZlI0AilFEvxHijb:CEjMioPwrZlI0AilFEvxHi

Score

10^/10

orcus persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

192.168.56.1:10134

Mutex

e1b0180577ab46efa4733e10a6bd85df

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Nursultan
watchdog_path
AppData\CrackLauncher.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015693-31.dat	family_orcus

Orcurs Rat Executable 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015693-31.dat	orcus
behavioral1/memory/2780-35-0x0000000000090000-0x000000000017C000-memory.dmp	orcus

Executes dropped EXE 4 IoCs

pid	Process
2780	Orcus.exe
1188	Orcus.exe
1424	CrackLauncher.exe
2856	CrackLauncher.exe

Loads dropped DLL 1 IoCs

pid	Process
1424	CrackLauncher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Orcus = "\"C:\\Program Files\\Orcus\\Orcus.exe\""	Orcus.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	Orcus.exe
2780	Orcus.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2856	CrackLauncher.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe
2780	Orcus.exe
2856	CrackLauncher.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	Orcus.exe
Token: SeDebugPrivilege	1424	CrackLauncher.exe
Token: SeDebugPrivilege	2856	CrackLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2780	Orcus.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	Orcus.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2060	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	28
PID 1640 wrote to memory of 2060	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	28
PID 1640 wrote to memory of 2060	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	28
PID 2060 wrote to memory of 2148	2060	csc.exe	30
PID 2060 wrote to memory of 2148	2060	csc.exe	30
PID 2060 wrote to memory of 2148	2060	csc.exe	30
PID 1640 wrote to memory of 2780	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	32
PID 1640 wrote to memory of 2780	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	32
PID 1640 wrote to memory of 2780	1640	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	32
PID 2564 wrote to memory of 1188	2564	taskeng.exe	34
PID 2564 wrote to memory of 1188	2564	taskeng.exe	34
PID 2564 wrote to memory of 1188	2564	taskeng.exe	34
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 2780 wrote to memory of 1424	2780	Orcus.exe	35
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36
PID 1424 wrote to memory of 2856	1424	CrackLauncher.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
"C:\Users\Admin\AppData\Local\Temp\374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qdqbe0i2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BCB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1BCA.tmp"
    3⤵
    PID:2148
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Roaming\CrackLauncher.exe
    "C:\Users\Admin\AppData\Roaming\CrackLauncher.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2780 /protectFile
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Users\Admin\AppData\Roaming\CrackLauncher.exe
      "C:\Users\Admin\AppData\Roaming\CrackLauncher.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2780 "/protectFile"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2856

C:\Windows\system32\taskeng.exe
taskeng.exe {81F7379E-4685-49EB-AD07-29F6443F9C5B} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Executes dropped EXE
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
915KB

MD5
5068ade29bf53c33416a18110c7abe26

SHA1
9ac01bd400d816ff2cbe003d1f4a729d6cb20615

SHA256
374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c

SHA512
649630c6b5959cb3e35e707748afda96b9ab21b247a8e5440a9a0c665da4ef030f7d71216b6a05bf99a4d6c86353dfa9a26507ea7a9b356fbdab2d031e93d5e7

Download Submit
C:\Program Files\Orcus\Orcus.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1BCB.tmp

Filesize
1KB

MD5
fb325b235980fefe57c45c76c58200af

SHA1
d14b599ed610f77a033166781067143fcae0566f

SHA256
39dd5ae565852eb691b6b20739df2c0d37b6b25831f54f328f8da253da12b5aa

SHA512
c211d6ae644f06709fdf036b1d0c011de2edacd0fc7ba6ef2dbd6ec0c5c64d55097a969a3dc087629fb9683c53c26a32370ad31104f38f329a5934ca91807836

Download Submit
C:\Users\Admin\AppData\Local\Temp\qdqbe0i2.dll

Filesize
76KB

MD5
9c076910b47222804c7b1b02a0c8c949

SHA1
c41e128679aaefbfc87a448eabbf3cfdb20285fc

SHA256
600857d13813c0857ca960f6ed9dfd760553884122f3bf35b2d4d67eeb6dd831

SHA512
3a42347bdd1574ace4e4edc3b56030eadf24930be6b4f938c05d4f0ca379ebbc2a76ee01f347cf48ae3f8838c3b2b62721701202f47c5512daca1f785f3f261e

Download Submit
C:\Users\Admin\AppData\Roaming\CrackLauncher.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\Orcus\err_e1b0180577ab46efa4733e10a6bd85df.dat

Filesize
1KB

MD5
d9f637bc5c54ac4037e8895e752651d1

SHA1
42b45928ec637fae5c9a93e343ac85de30ac82c2

SHA256
969cf4d0c46c021b9a86bfe2436f8fd3d5a1c2bba933a58d3b89f7b4c7aef329

SHA512
83ded7169d8eff7c59ba27e796b1e3da08c017b97bf1e3c2aa98a37706b93cce3b720254560081b64ac1c252754615bbdfed46c366444217eed2d91300c438a5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC1BCA.tmp

Filesize
676B

MD5
15b6d6afbcf7f2a6a322083593c2965b

SHA1
882ad69ed947376b89426c29e8058ff3517449c8

SHA256
fd439f2f8bc6800614b00f642ff89461fb1312cf78b01649024d6119a532124a

SHA512
29bcc2b26d4bf2eb1503c6f5d53cf61a44ed54a908a3566fdceb30133d6f4e45a79e3e479dbbdeb4d50803ee98f6caacfc9ea4fdd1071067125607fb00312000

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qdqbe0i2.0.cs

Filesize
208KB

MD5
2b14ae8b54d216abf4d228493ceca44a

SHA1
d134351498e4273e9d6391153e35416bc743adef

SHA256
4e1cc3da1f7bf92773aae6cffa6d61bfc3e25aead3ad947f6215f93a053f346c

SHA512
5761b605add10ae3ef80f3b8706c8241b4e8abe4ac3ce36b7be8a97d08b08da5a72fedd5e976b3c9e1c463613a943ebb5d323e6a075ef6c7c3b1abdc0d53ac05

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qdqbe0i2.cmdline

Filesize
349B

MD5
208a2e6f82efacb82b0bffa203dcb719

SHA1
2f06abce2ed3ad8e8a602d180f068420b6d27077

SHA256
3194d851df948d4f5b8e0195e682dbfaec934d471f0918ec7137725f6fa4957b

SHA512
a288871396a0a913d6be335cc1ce69014b4e411f9256593a6d113b461395d1a7539180d8c543019f74820fe1be446d5ce36a8e7249d79359f1df7575d981cf4a

Download Submit
memory/1424-51-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/1640-21-0x00000000006E0000-0x00000000006E8000-memory.dmp

Filesize
32KB

Download
memory/1640-4-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/1640-20-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1640-22-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/1640-0-0x000007FEF4F8E000-0x000007FEF4F8F000-memory.dmp

Filesize
4KB

Download
memory/1640-23-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/1640-29-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/1640-18-0x0000000000980000-0x0000000000996000-memory.dmp

Filesize
88KB

Download
memory/1640-33-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/1640-1-0x0000000000920000-0x000000000097C000-memory.dmp

Filesize
368KB

Download
memory/1640-2-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1640-3-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-13-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2060-54-0x000007FEF4CD0000-0x000007FEF566D000-memory.dmp

Filesize
9.6MB

Download
memory/2780-36-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/2780-39-0x0000000002170000-0x00000000021BE000-memory.dmp

Filesize
312KB

Download
memory/2780-40-0x00000000023D0000-0x00000000023E8000-memory.dmp

Filesize
96KB

Download
memory/2780-41-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/2780-35-0x0000000000090000-0x000000000017C000-memory.dmp

Filesize
944KB

Download