Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22-07-2024 01:01
General
-
Target
803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe
-
Size
3.0MB
-
MD5
1c442246340be6c7f7d70150c5626ffd
-
SHA1
f74d1e6721db9163a7746755633b2a11aa064448
-
SHA256
803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43
-
SHA512
cf081aa1c10b2614bf10d54eff218bbb09b52d76b30a900411df3490fbb0ffa3134c66826315e681a42bee52ba433924005efc4393a6423bfd433b01e80929aa
-
SSDEEP
49152:V+LEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmvwsrZz:V+LtODUKTslWp2MpbfGGilIJPypSbxEl
Malware Config
Extracted
orcus
127.0.0.1:10134
0ece821d7cdc4863af5a95c1f4a79898
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus main payload 2 IoCs
-
Orcurs Rat Executable 3 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe"C:\Users\Admin\AppData\Local\Temp\803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wys6g0-n.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB68F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB68E.tmp"3⤵
-
-
-
C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 28083⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe"C:\Users\Admin\AppData\Local\Temp\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 28084⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD51c442246340be6c7f7d70150c5626ffd
SHA1f74d1e6721db9163a7746755633b2a11aa064448
SHA256803776c8b23ad99dbd923575c31303896d5d00b431d712bef1594369ddd57c43
SHA512cf081aa1c10b2614bf10d54eff218bbb09b52d76b30a900411df3490fbb0ffa3134c66826315e681a42bee52ba433924005efc4393a6423bfd433b01e80929aa
-
Filesize
349B
MD589817519e9e0b4e703f07e8c55247861
SHA14636de1f6c997a25c3190f73f46a3fd056238d78
SHA256f40dfaa50dcbff93611d45607009158f798e9cd845170939b1d6088a7d10ee13
SHA512b017cb7a522b9c6794f3691cb7266ec82f565a90d7d07cc9beb53b939d2e9bf34275bc25f6f32d9a9c7136a0aab2189d9556af7244450c610d11ed7a4f584ba3
-
Filesize
3.0MB
MD51e03f7964093b61bd06d3d93a1a23840
SHA1b249fc42263fb0b5d4f6821de36981efb5ea1055
SHA2566d884a0ecfe3112cae0349c92ba7c17c2d2928fdb8e01ae5a2277d6e47b17b9f
SHA512e2793c44a686d1e1361131e89b0f4d89846a1261ecbaa6712b25f9f30b39385755267283280d98314112335cdbf6c8abf6d4e52c5b330706453914ef0e83c718
-
Filesize
9KB
MD57a195b6c9de2d5cab015f649da6931a1
SHA189f7372dd92a90a8e13b74ee512b464412e4cf9b
SHA25630183935449a625c2a61f6342dc3b9907028194173f2e3d594eaa3126ee316bc
SHA5123c2aeef85b51e7f955072fba042bcedf8dd0b66ad813def58c0134355665ba56a713d58005a322561c62be5777d0adea2803da214459f362f22fe2a0dba5a1c7
-
Filesize
1KB
MD5c64681e50e0c828c74abb10a31fb9d7d
SHA1a3661ff38a8198701b14a4f9a33d3340796b93a7
SHA256804e9ae7a0798654b4c11d997dc40614a0c214dac5a8f30b9e1acab93fbfe04c
SHA5126c99f9072039e2766261396a959a65222bdd460944fcec1da2987994a39c68cbcc191925f1120cec2c056bfe5b8e06ad0dcb2ee77494223ecaba76b5ad9cad19
-
Filesize
76KB
MD5d11fed11d528a8a5cc8cad8a1407bb36
SHA1383d07d1de485446890121d5a5b7751f72cd239e
SHA256694f672312bd7770a6245fcf512c9185e679c399a22a767bd9e3ee0fcd49c30c
SHA51207aba703c905002c8115e4fb18a8fbe7fa49c4d8a8624f2df93e101bcbac7f0671666c2e31f1ac66c39b839fdd739e6bcf2303a8bd1fc5e93332fed71b480c35
-
Filesize
676B
MD56e633ea820c157f548eab50390af5a6c
SHA14bd355b2aa47f05b42a41fa629d1aa1a86ad9138
SHA25648512a9294bbefc05f0fda29c408dea3f42088484473f59d9b85d64df4bdd167
SHA512e5adc9ed6b4ff74e6adae8a571c29f32b23bc0497547ffb1ac5e27e217d82653cee6f9693e9b3d1d62395985721fe096846e2707ec048f904266819b2e466a8d
-
Filesize
208KB
MD5fef9663ec6866f04e9b7a00685eb136b
SHA14951b4d83297a6a96ad0610f5f5ca7dedf63af76
SHA2563a79dfee7ffa5a851d6bf80e8e6e9f99cf597894bd57b1b596d55287b3674f8a
SHA5120d7fad474f358189abf830e4f9148ae9cf6d4018d0b385d22d96b5d06660878918d09b37ab8e8471a7a958e76bfa03ef6145958e1c958251e81047a6ec6f8d84
-
Filesize
349B
MD5e2b8e79dc571d661289a75d3a66f18a8
SHA1d55e50d5169eaa11354db521bff33330691e1ca3
SHA2567f48031a2f742b5e7abf29e84d21b6469ed3c5000d34596bc3f17ac76d7c7875
SHA5121a36f5de7184f224dc50d98bf4fcde4a7c95d3f93faab92a6d4641903035ec5e5b533dbbda27d837b1c24f7d399672b23d5622dcd8e7bade7e66e684d05b6e06
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
56KB
-
Filesize
128KB
-
Filesize
88KB
-
Filesize
4.8MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
528KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
192KB
-
Filesize
464KB
-
Filesize
3.0MB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
592KB
-
Filesize
196KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
248KB
-
Filesize
176KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
9.6MB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
160KB
-
Filesize
152KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
136KB
-
Filesize
112KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
160KB
-
Filesize
120KB
-
Filesize
152KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
128KB
-
Filesize
568KB
-
Filesize
56KB
-
Filesize
368KB
-
Filesize
9.6MB
-
Filesize
4KB