Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 01:44

General

  • Target

    1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d.exe

  • Size

    1.0MB

  • MD5

    3cbe692d9a0c395dabd70e96986d53b5

  • SHA1

    cf495ae9f11d7cbe1cfb8051684fe3c95e9615b8

  • SHA256

    1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d

  • SHA512

    ef82faa953f3ebff013841954a65b40e726692f0798ca84767e20354e344e40a0ba82723248364aafab91f839200c7bd20863c9e81e1134c43158144420c2485

  • SSDEEP

    24576:/3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PykywO+://etqzXOu1Ff9DtTyM9

Malware Config

Extracted

Family

orcus

C2

45.157.69.156:443

Mutex

3b453ed253424c82a94898f42bb6a1be

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcurs Rat Executable 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d.exe
    "C:\Users\Admin\AppData\Local\Temp\1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2316-0-0x000007FEF5033000-0x000007FEF5034000-memory.dmp

    Filesize

    4KB

  • memory/2316-1-0x000000013F0D0000-0x000000013F1D2000-memory.dmp

    Filesize

    1.0MB

  • memory/2316-2-0x000007FEF5033000-0x000007FEF5034000-memory.dmp

    Filesize

    4KB

  • memory/2316-3-0x000000001BA20000-0x000000001BB08000-memory.dmp

    Filesize

    928KB

  • memory/2316-4-0x00000000023E0000-0x000000000243C000-memory.dmp

    Filesize

    368KB

  • memory/2316-5-0x00000000007B0000-0x00000000007BE000-memory.dmp

    Filesize

    56KB

  • memory/2316-6-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

    Filesize

    9.9MB

  • memory/2316-7-0x0000000000800000-0x0000000000812000-memory.dmp

    Filesize

    72KB

  • memory/2316-8-0x0000000002340000-0x0000000002358000-memory.dmp

    Filesize

    96KB

  • memory/2316-9-0x00000000007F0000-0x0000000000800000-memory.dmp

    Filesize

    64KB

  • memory/2316-10-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

    Filesize

    9.9MB