Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
20-07-2024 15:55
General
-
Target
Orcus RAT 1.9.1/Orcus.Administration/Orcus.Administration.exe
-
Size
3.9MB
-
MD5
37349777df1cc9c8d3d62eb733f7cd45
-
SHA1
456233fa947ab155dbe5636eda0a77346197bb4c
-
SHA256
0121f2d7ddc074ffa05619dbb2a4b555a4b550168a765b57fa8bd9298a7e4b52
-
SHA512
ca4e1a39dbb0fa0c6bbef7142cf457856cc2db14c03b5b9ea5c28811a3a70cc05505320f50e133e166aad25d779ac043b0f29b09bb34a342f5111603cc5dd074
-
SSDEEP
49152:VZV/t1QLjeVxAl40NVANW8cyTXTG1H66VbTWnepAl4:VZVDVxAl40NG48cyTKjVbTWnepAl4
Malware Config
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe"C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe"C:\Users\Admin\AppData\Local\Temp\Orcus RAT 1.9.1\Orcus.Administration\Orcus.Administration.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53dd6d1e944fba4e73004887f29d900d1
SHA10004adb072c67367f5f0b019fce8cb4b61048f8b
SHA2561049a780823492409fcad044c1a05034f741abb2f0aa8b99369f860085ea4c17
SHA51274e86c903f3b3be79a89add61e1cd2707a0c6f159eff671baf4610b61eb2f4b00b6582c51d18c7fd75525504caa51bfcd858ae3a7f9ada84fc1f3ebac3a14eb4
-
Filesize
924B
MD5f52bc81b9bd5fd71892b5a9455a7acc9
SHA1671ce63a513aef4ada032dea0056cb4879d9838b
SHA2566078c4dd16f55d29b426d9fc002124cfd65efe54ed056a564cc9f0a68f1813ff
SHA51269bfcff1dfb57d6f5fbafb3c01d6c27064d816c923ad4257ee879f5601a22f271d8e5a62eac8e97e90a73f0d100a784275b9ae2a104b383e3e9dd7c8c43fb0f8
-
Filesize
224KB
-
Filesize
4.0MB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
1.2MB
-
Filesize
136KB
-
Filesize
1.2MB
-
Filesize
80KB
-
Filesize
112KB
-
Filesize
200KB
-
Filesize
536KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
368KB
-
Filesize
704KB
-
Filesize
200KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
2.6MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
13.2MB
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
760KB
-
Filesize
7.7MB
-
Filesize
880KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
32KB
-
Filesize
6.1MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB