Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-10-2024 01:19
General
-
Target
fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905.exe
-
Size
903KB
-
MD5
1b1ed829d9d28de97a67b4deef9611fd
-
SHA1
f721c2092d2ea32270bdfd4e01e3af6f6d983730
-
SHA256
fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905
-
SHA512
6d05651ba20296ac8053322bbe4fe912d1d580b30202d4c047f9c6dfb4fcc45c0bec22223a11a7d0e741ae4572d4b5745e37f7abb14ee99f37b710a1b6760598
-
SSDEEP
12288:i0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCBfm9rR6W7BaepBwzo7dG1lFlWx:Xam4MROxnF4OVrrcI0AilFEvxHPOooh
Malware Config
Extracted
orcus
0.tcp.ap.ngrok.io:14759
e76402febf5a462e951739e787591097
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905.exe"C:\Users\Admin\AppData\Local\Temp\fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
56KB
-
Filesize
6.9MB
-
Filesize
368KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
6.9MB