Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-08-2024 01:09
General
-
Target
3d5caa3fe15a6cd9caa0ee8f62b69f5a0bf6c736cf253ef1a341c403345f8ffb.exe
-
Size
2.6MB
-
MD5
ce63a6eb98047c1835c7850d62de72b5
-
SHA1
04bfcbc820e4fa1d8f2a24c3482d21526f6c8ee9
-
SHA256
3d5caa3fe15a6cd9caa0ee8f62b69f5a0bf6c736cf253ef1a341c403345f8ffb
-
SHA512
c198eb982233712c07e6a49c97e34a988e9b62e624cb68b95d23b652cd396ea48220d63a536bce1a116446a9199902ea751d79e350e143fe54f39002c84bb5da
-
SSDEEP
49152:n1TKZKMuX7vnQ27/AypQxbfo9JnCmo2rDnIgAiEFCvxHIy:nnl7t4ypSbfo9JCm
Malware Config
Extracted
orcus
172.111.150.125:5000
08f8182eae5443eea134ba463015f3eb
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d5caa3fe15a6cd9caa0ee8f62b69f5a0bf6c736cf253ef1a341c403345f8ffb.exe"C:\Users\Admin\AppData\Local\Temp\3d5caa3fe15a6cd9caa0ee8f62b69f5a0bf6c736cf253ef1a341c403345f8ffb.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
56KB
-
Filesize
368KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB