Analysis

  • max time kernel
    220s
  • max time network
    225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-07-2024 04:06

General

  • Target

    OrbitExecutor/Orbit.exe

  • Size

    628KB

  • MD5

    1e420dfa64720d837db1e455dc9ee2ac

  • SHA1

    6fc393cc32b0034383d2e8852573deb4a0344d0f

  • SHA256

    96b235e33183fa716d4a07a65be9955026e2b3228cdc9402f716eee6adc7bdf1

  • SHA512

    cc231d4f126c650eb98791a402816c82a825fd434b38429915bfe1185393aa1223f16ae69c01d197fdb386c60d924e2016a92c714efe6b7e4b108bb30454bd1e

  • SSDEEP

    12288:1yNvYJ94KY+q7Wk4VUjtQSOSyQgEQEJJU+kFGUYlYr:I1J0yYVkeSytNEJJU+47

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OrbitExecutor\Orbit.exe
    "C:\Users\Admin\AppData\Local\Temp\OrbitExecutor\Orbit.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 2780
        3⤵
        • Program crash
        PID:3036
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2068 -ip 2068
    1⤵
      PID:2720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\d3d9.dll

      Filesize

      627KB

      MD5

      3d1fd85897344a19d1530eabb990f426

      SHA1

      189d0625a4e57eed3dc80177c95f9786b4f53dc1

      SHA256

      9253ae4acf96dfb95e3b875a2f463d3bdc0b59c4f215d41bc0c86badd0fcc7c9

      SHA512

      3cf1c417b7b177af7894732ac97268d1bdc84375f13bfc04e745fcc7e18aeb2f8407e38aaaa623d9d42f2eb4feba982efd10f3529d79b344ef072250e83e7a05

    • memory/2068-16-0x0000000008C00000-0x0000000009218000-memory.dmp

      Filesize

      6.1MB

    • memory/2068-11-0x00000000743F0000-0x0000000074BA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2068-17-0x0000000008700000-0x000000000880A000-memory.dmp

      Filesize

      1.0MB

    • memory/2068-19-0x00000000086B0000-0x00000000086EC000-memory.dmp

      Filesize

      240KB

    • memory/2068-18-0x0000000008650000-0x0000000008662000-memory.dmp

      Filesize

      72KB

    • memory/2068-12-0x0000000005DD0000-0x0000000006374000-memory.dmp

      Filesize

      5.6MB

    • memory/2068-13-0x0000000005940000-0x00000000059D2000-memory.dmp

      Filesize

      584KB

    • memory/2068-14-0x00000000743F0000-0x0000000074BA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2068-15-0x00000000059F0000-0x00000000059FA000-memory.dmp

      Filesize

      40KB

    • memory/2068-28-0x00000000743F0000-0x0000000074BA0000-memory.dmp

      Filesize

      7.7MB

    • memory/2068-8-0x0000000000400000-0x0000000000476000-memory.dmp

      Filesize

      472KB

    • memory/2068-27-0x000000000A9C0000-0x000000000AEEC000-memory.dmp

      Filesize

      5.2MB

    • memory/2068-26-0x000000000A2C0000-0x000000000A482000-memory.dmp

      Filesize

      1.8MB

    • memory/2068-20-0x0000000008810000-0x000000000885C000-memory.dmp

      Filesize

      304KB

    • memory/2068-23-0x0000000008AB0000-0x0000000008B16000-memory.dmp

      Filesize

      408KB

    • memory/2068-24-0x00000000099E0000-0x0000000009A56000-memory.dmp

      Filesize

      472KB

    • memory/2068-25-0x0000000009960000-0x000000000997E000-memory.dmp

      Filesize

      120KB

    • memory/4472-10-0x00000000743F0000-0x0000000074BA0000-memory.dmp

      Filesize

      7.7MB

    • memory/4472-1-0x00000000002A0000-0x0000000000344000-memory.dmp

      Filesize

      656KB

    • memory/4472-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

      Filesize

      4KB

    • memory/4472-29-0x00000000743F0000-0x0000000074BA0000-memory.dmp

      Filesize

      7.7MB