Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
22-07-2024 01:01
General
-
Target
803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe
-
Size
3.0MB
-
MD5
1c442246340be6c7f7d70150c5626ffd
-
SHA1
f74d1e6721db9163a7746755633b2a11aa064448
-
SHA256
803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43
-
SHA512
cf081aa1c10b2614bf10d54eff218bbb09b52d76b30a900411df3490fbb0ffa3134c66826315e681a42bee52ba433924005efc4393a6423bfd433b01e80929aa
-
SSDEEP
49152:V+LEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmvwsrZz:V+LtODUKTslWp2MpbfGGilIJPypSbxEl
Malware Config
Extracted
orcus
127.0.0.1:10134
0ece821d7cdc4863af5a95c1f4a79898
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 1 IoCs
-
Orcurs Rat Executable 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe"C:\Users\Admin\AppData\Local\Temp\803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhyb9jer.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC54E.tmp"3⤵
-
-
-
C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 17403⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 17404⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2711A9DA-3452-4D4D-9585-9A09AFE5BCBD} S-1-5-21-2172136094-3310281978-782691160-1000:EXCFTDUU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD51c442246340be6c7f7d70150c5626ffd
SHA1f74d1e6721db9163a7746755633b2a11aa064448
SHA256803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43
SHA512cf081aa1c10b2614bf10d54eff218bbb09b52d76b30a900411df3490fbb0ffa3134c66826315e681a42bee52ba433924005efc4393a6423bfd433b01e80929aa
-
Filesize
349B
MD589817519e9e0b4e703f07e8c55247861
SHA14636de1f6c997a25c3190f73f46a3fd056238d78
SHA256f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13
SHA512b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3
-
Filesize
9KB
MD57a195b6c9de2d5cab015f649da6931a1
SHA189f7372dd92a90a8e13b74ee512b464412e4cf9b
SHA25630183935449a625c2a61f6342dc3b9907028194173f2e3d594eaa3126ee316bc
SHA5123c2aeef85b51e7f955072fba042bcedf8dd0b66ad813def58c0134355665ba56a713d58005a322561c62be5777d0adea2803da214459f362f22fe2a0dba5a1c7
-
Filesize
1KB
MD57100f109f2c8f8d6599e07dd577f05e3
SHA178f00eba82db6826eedb5404d2659ac676306678
SHA256de22a91546678e1d920e8241691633c9bf34cec454ea64653381b8da55590cca
SHA512690a7c0de5ca2d838926049afff5ec018b6bc26ebe94e13d5e6ab02a7481dc6fc5fb100505ba15f99a8d61ae8d20d6cb5faa56ae3f1510ad9d7c1f24a3fb23d3
-
Filesize
76KB
MD54860e344308d20ed885b302c51131678
SHA1b1964041035d49c7bc20247f980945f7f0ed4af1
SHA2561c5585ece943a7d180fad66730e2a55cb9b18ae2bfecb19e656d0e1c56a3f8d2
SHA512525fdd8103b1cd55a0ade1d1b0cd88430fbe8a1fec90534893f51024d13b6ee42ca3f9cf663cfcdb0472e6a112fd0973a43f76d889b032a6ffd8d211597011d3
-
Filesize
676B
MD5e31cf4117b5a3848b82efb433e3447a8
SHA1ec0e011e46e609c7e7444e12912eb6ea8acd7b82
SHA25618ee0be5345231820d5acb3c5533dd5b732196461316f8ef4bd4f8c1a0616bbd
SHA5129368ce551a26becd4b6d04c31fd2f901a7723b3ac8e390c207ead78d23683c5771e773b92ee7de0c72728e8b515833df3f4b92a89742d6b46b26b190ab5cd07c
-
Filesize
208KB
MD5d9f26c56ba4d303302b58923e3f3b601
SHA1145d52165ef6092193233b7e80013a6e8a848e53
SHA2561abe714f9efc1de74cb7cfbbb98f90e74fca759f4e43ee79899120b95d3f3dee
SHA51281cb00a99c695f2df192754c1c12374ec108688486d956089a60e249bf250b92bad1ed5f2a1155d7eaa9f15c1131778751b5d4e5707c3744c6a2bd5c6755379a
-
Filesize
349B
MD5d174d4f082ac9db548d90aeec8811469
SHA1355028c72e59b3a5ef094a000e12bf82fdb39412
SHA25651ada6b389e762bcd452be346e1f83907ce59f25e8ca82f324b83f330f79db55
SHA5121800faff66866ea3d47c3d4c0c0e6b1d42347ddf378cb619dacf438b11b4b92efb936fa5106dfcfd59a20ced970b626320ca32c58a060c979216102b32ca45fd
-
Filesize
48KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
344KB
-
Filesize
3.0MB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
96KB
-
Filesize
236KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
152KB
-
Filesize
96KB
-
Filesize
1.0MB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
152KB
-
Filesize
112KB
-
Filesize
236KB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
852KB
-
Filesize
160KB
-
Filesize
128KB
-
Filesize
152KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
9.6MB
-
Filesize
80KB
-
Filesize
48KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
136KB
-
Filesize
112KB
-
Filesize
176KB
-
Filesize
80KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
852KB
-
Filesize
160KB
-
Filesize
152KB
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
48KB
-
Filesize
368KB
-
Filesize
56KB
-
Filesize
9.6MB
-
Filesize
9.6MB