Analysis
- max time kernel
1188s - max time network
1198s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 16:57
General
- Target java.exe
- Size 912KB
- Sample240720-vgqaaswarm
- SHA256 8fe37b9605617ca26443064f74eaaf156f43c7ef80deaecdc71eb5688f4cc255
Malware Config
Extracted
-
orcus
-
0.tcp.eu.ngrok.io:10019
-
a6fa2ae42e784c859e6a44e0e55cd75b
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcurs Rat Executable 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\java.exe"C:\Users\Admin\AppData\Local\Temp\java.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2304-1-0x0000000000220000-0x000000000030A000-memory.dmp
memory/2304-0-0x00007FFF22B93000-0x00007FFF22B95000-memory.dmp
memory/2304-2-0x0000000000C80000-0x0000000000CDC000-memory.dmp
memory/2304-3-0x0000000000B10000-0x0000000000B1E000-memory.dmp
memory/2304-4-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp
memory/2304-5-0x0000000000B60000-0x0000000000B72000-memory.dmp
memory/2304-6-0x0000000000B50000-0x0000000000B58000-memory.dmp
memory/2304-7-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
memory/2304-8-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/2304-9-0x0000000002550000-0x000000000258C000-memory.dmp
memory/2304-10-0x000000001CE50000-0x000000001CF5A000-memory.dmp
memory/2304-12-0x0000000000D40000-0x0000000000D58000-memory.dmp
memory/2304-13-0x0000000002590000-0x00000000025A0000-memory.dmp
memory/2304-16-0x000000001DB70000-0x000000001DD32000-memory.dmp
memory/2304-19-0x00007FFF22B93000-0x00007FFF22B95000-memory.dmp
memory/2304-20-0x00007FFF22B90000-0x00007FFF23651000-memory.dmp