orcus | 374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
Size

915KB
MD5

5068ade29bf53c33416a18110c7abe26
SHA1

9ac01bd400d816ff2cbe003d1f4a729d6cb20615
SHA256

374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c
SHA512

649630c6b5959cb3e35e707748afda96b9ab21b247a8e5440a9a0c665da4ef030f7d71216b6a05bf99a4d6c86353dfa9a26507ea7a9b356fbdab2d031e93d5e7
SSDEEP

24576:CEqr4MROxnFi3PrkrZlI0AilFEvxHijb:CEjMioPwrZlI0AilFEvxHi

Score

10^/10

orcus persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

192.168.56.1:10134

Mutex

e1b0180577ab46efa4733e10a6bd85df

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Nursultan
watchdog_path
AppData\CrackLauncher.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023404-42.dat	family_orcus

Orcurs Rat Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023404-42.dat	orcus
behavioral2/memory/2464-54-0x0000000000380000-0x000000000046C000-memory.dmp	orcus

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Orcus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	CrackLauncher.exe

Executes dropped EXE 4 IoCs

pid	Process
2464	Orcus.exe
3256	Orcus.exe
3532	CrackLauncher.exe
3000	CrackLauncher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Orcus = "\"C:\\Program Files\\Orcus\\Orcus.exe\""	Orcus.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File opened for modification	C:\Windows\assembly	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
File created	C:\Windows\assembly\Desktop.ini	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2464	Orcus.exe
2464	Orcus.exe
2464	Orcus.exe
3000	CrackLauncher.exe
3000	CrackLauncher.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe
2464	Orcus.exe
3000	CrackLauncher.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	Orcus.exe
Token: SeDebugPrivilege	3532	CrackLauncher.exe
Token: SeDebugPrivilege	3000	CrackLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2464	Orcus.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	Orcus.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2840	4864	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	83
PID 4864 wrote to memory of 2840	4864	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	83
PID 2840 wrote to memory of 3260	2840	csc.exe	85
PID 2840 wrote to memory of 3260	2840	csc.exe	85
PID 4864 wrote to memory of 2464	4864	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	87
PID 4864 wrote to memory of 2464	4864	374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe	87
PID 2464 wrote to memory of 3532	2464	Orcus.exe	89
PID 2464 wrote to memory of 3532	2464	Orcus.exe	89
PID 2464 wrote to memory of 3532	2464	Orcus.exe	89
PID 3532 wrote to memory of 3000	3532	CrackLauncher.exe	90
PID 3532 wrote to memory of 3000	3532	CrackLauncher.exe	90
PID 3532 wrote to memory of 3000	3532	CrackLauncher.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe
"C:\Users\Admin\AppData\Local\Temp\374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\inpxg1_i.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC71E4.tmp"
    3⤵
    PID:3260
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Roaming\CrackLauncher.exe
    "C:\Users\Admin\AppData\Roaming\CrackLauncher.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2464 /protectFile
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Users\Admin\AppData\Roaming\CrackLauncher.exe
      "C:\Users\Admin\AppData\Roaming\CrackLauncher.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2464 "/protectFile"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3000

C:\Program Files\Orcus\Orcus.exe
"C:\Program Files\Orcus\Orcus.exe"
1⤵
- Executes dropped EXE
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
915KB

MD5
5068ade29bf53c33416a18110c7abe26

SHA1
9ac01bd400d816ff2cbe003d1f4a729d6cb20615

SHA256
374a4654f2a5ef4061fdf971cb43f808b16502e4eab1c0f969d2a7194e6dee0c

SHA512
649630c6b5959cb3e35e707748afda96b9ab21b247a8e5440a9a0c665da4ef030f7d71216b6a05bf99a4d6c86353dfa9a26507ea7a9b356fbdab2d031e93d5e7

Download Submit
C:\Program Files\Orcus\Orcus.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CrackLauncher.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES71E5.tmp

Filesize
1KB

MD5
0203343d992e2cd0782e7383f28ff998

SHA1
9e18fa55d50f32bf1123935bb84f7fe78cdcd2a2

SHA256
3e0b6f8d3f49f9ae8e0081d68370de3e4072b39c740ab291c7072946234257e9

SHA512
d60f75f097bbeed50c283ceb3b678dc9f8091e71797cd91dde0a09f9f661e77a3b4b022db17b5db1a4645e82d0fc099091ecf479047bcda4102d39727040f6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\inpxg1_i.dll

Filesize
76KB

MD5
fece9429dcf76f6f6aa7367b0740f6f0

SHA1
c0338ecc4d0247cc68331b181b82568d12bfa129

SHA256
bf7c739b2abb81209e8d738aa3fb1547816b9cf8493fbff192d4868b77ff192a

SHA512
409614e1cfb622934ce6df242272beea190a3d972b60147dd04ff3b9833eff4ca690c051881ab82b5ec3f93bf98bd99973fae3161efa17d222b18c6845f9857b

Download Submit
C:\Users\Admin\AppData\Roaming\CrackLauncher.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Roaming\Orcus\err_e1b0180577ab46efa4733e10a6bd85df.dat

Filesize
1KB

MD5
27af32eba14dcc5485021250864bb3d2

SHA1
a7a6a9c1d6150493f3f3aa3beb2efa24aaca9f5f

SHA256
661555f327b9adf2aa10a4d7ee9a6a9779f173071da9feef816dcf1b4282306f

SHA512
1ece49119eacadb8cce928792c5016a96f9c3a5df825231bbb51aa049671c7215eb68913d5ef5d9916e6599279b9126a72d6f4ed395d2bfb236383d3e9eb2440

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC71E4.tmp

Filesize
676B

MD5
90b8de47e152a1e5a4b603183c7ae4b8

SHA1
70f36c3d1fe50dbf6bbf1983978e19f334bfafe0

SHA256
b250ba8a1902bfa32028e212c0611bec9e54f9bb4e46e5807714a872dda2fa20

SHA512
c5348736de5e5f7fa41dd3c8cbdf72aec796ed2273f0d78117c50ae4d8298d0b86b2ac5660379aeba81cda0c58e71ad5100b5c6dab9e3d4b5ab7efb28c7b2f90

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\inpxg1_i.0.cs

Filesize
208KB

MD5
2b47c1bfe18d5ed59467c9dc59b59f63

SHA1
021b6c74e477e8ef26795006b611733d479840a0

SHA256
5c8630c37149d0a7178eb944b5f762d09bf0de8d7e29a396af9c8676712540af

SHA512
7f787e4ec93c419865fdd7f66cd64d64b6d88fe6d6740992ac349ee6433231b2b44f52da1673f2598304ea87e46f0c98f22087975c6d02fbe684736a7860cdf7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\inpxg1_i.cmdline

Filesize
349B

MD5
ee91635d3e041a5fde564c09d006c9d5

SHA1
3c5a13e7174975c1a8ffc1381d5e4505d7bd4f9a

SHA256
3f531af9c245aa2a8247b6bbbb7d0af773b3f0a1c6dfad32e91655dd75f7fc22

SHA512
8c2cfb7e37a64fca440c75056f52d3389e68e81cf26bc715967c695ad59c6dfd6162f43a9a5577de380bbade8df1924b2eb348b374c4324a9af7f850ccdcd21d

Download Submit
memory/2464-57-0x000000001B290000-0x000000001B2CC000-memory.dmp

Filesize
240KB

Download
memory/2464-56-0x000000001B110000-0x000000001B122000-memory.dmp

Filesize
72KB

Download
memory/2464-53-0x00007FFF64B53000-0x00007FFF64B55000-memory.dmp

Filesize
8KB

Download
memory/2464-84-0x00007FFF64B53000-0x00007FFF64B55000-memory.dmp

Filesize
8KB

Download
memory/2464-54-0x0000000000380000-0x000000000046C000-memory.dmp

Filesize
944KB

Download
memory/2464-65-0x000000001C770000-0x000000001C780000-memory.dmp

Filesize
64KB

Download
memory/2464-64-0x000000001C9B0000-0x000000001CB72000-memory.dmp

Filesize
1.8MB

Download
memory/2464-63-0x000000001B340000-0x000000001B358000-memory.dmp

Filesize
96KB

Download
memory/2464-61-0x000000001B2D0000-0x000000001B31E000-memory.dmp

Filesize
312KB

Download
memory/2464-58-0x000000001C100000-0x000000001C20A000-memory.dmp

Filesize
1.0MB

Download
memory/2464-55-0x00000000025E0000-0x00000000025F2000-memory.dmp

Filesize
72KB

Download
memory/2840-16-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/2840-21-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/3532-79-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/4864-6-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/4864-0-0x00007FFF67405000-0x00007FFF67406000-memory.dmp

Filesize
4KB

Download
memory/4864-7-0x000000001B9F0000-0x000000001BEBE000-memory.dmp

Filesize
4.8MB

Download
memory/4864-34-0x000000001DB10000-0x000000001DB80000-memory.dmp

Filesize
448KB

Download
memory/4864-52-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/4864-33-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/4864-32-0x000000001DA30000-0x000000001DA79000-memory.dmp

Filesize
292KB

Download
memory/4864-31-0x000000001CB70000-0x000000001CB8E000-memory.dmp

Filesize
120KB

Download
memory/4864-30-0x000000001D930000-0x000000001DA20000-memory.dmp

Filesize
960KB

Download
memory/4864-35-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/4864-29-0x000000001D370000-0x000000001D92A000-memory.dmp

Filesize
5.7MB

Download
memory/4864-2-0x000000001B320000-0x000000001B37C000-memory.dmp

Filesize
368KB

Download
memory/4864-28-0x000000001CA10000-0x000000001CA72000-memory.dmp

Filesize
392KB

Download
memory/4864-27-0x000000001B2B0000-0x000000001B2B8000-memory.dmp

Filesize
32KB

Download
memory/4864-26-0x000000001B1F0000-0x000000001B1F8000-memory.dmp

Filesize
32KB

Download
memory/4864-25-0x000000001B270000-0x000000001B282000-memory.dmp

Filesize
72KB

Download
memory/4864-5-0x000000001B510000-0x000000001B51E000-memory.dmp

Filesize
56KB

Download
memory/4864-23-0x000000001C620000-0x000000001C636000-memory.dmp

Filesize
88KB

Download
memory/4864-1-0x00007FFF67150000-0x00007FFF67AF1000-memory.dmp

Filesize
9.6MB

Download
memory/4864-8-0x000000001BF60000-0x000000001BFFC000-memory.dmp

Filesize
624KB

Download