Analysis
-
max time kernel
35s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 15:59
General
-
Target
OrcusRAT-main.zip
-
Size
25.0MB
-
MD5
4ebe8621171038676189cbc5e7053d9f
-
SHA1
2e3a3b97163d1e8af1e41c36f9495062fb4b1934
-
SHA256
3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3
-
SHA512
e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356
-
SSDEEP
786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk
Malware Config
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Orcurs Rat Executable 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 33 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OrcusRAT-main.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe"C:\Users\Admin\Desktop\OrcusRAT-main\Orcus.Administration.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD51fc04b8bb4896745163df806695ee193
SHA139174ce2fca9a3e86bb7a5686037bc42f2572de1
SHA2563f2b2fd440fdd84288dadfc63e37a4bc7ea0aae26889ab0d4a5ef6148f44ce14
SHA5123ff18bdd364f27e54ffbf2d1af53e3500ec57e7e8fa14185f7fb1ef6639d69ac6253543b9e2155ade45ca5bcd567e94334f1ee7ad0a7ff28194168dc49883261
-
Filesize
16.2MB
MD5a6347e4e194adb6d2a3fae52598d8cdd
SHA1aa06c496c20d6e04142d4a5205a032680a452a0d
SHA256911e3e95efddbae9d1c2f4b04027567c76823116755097b5868b7241c7e30cbc
SHA5122ee24604c0edbc09096e2344ca6c1f74b1067b9aff7f077d0b4e42cd8f51dd1116e98016e34f0a1d951fcdbc8bfed33b1709a9692ba95b3ea3cd84d9ce080922
-
Filesize
1KB
MD52846ec087e67923c130a5b875193c893
SHA1ab1049f2531941cb98e99e5f83e8fb6b5be3a7f4
SHA256148dc241bfa25e5fda9ebef2d315aa95121f9468da29dc167573f32f14733d08
SHA512a332471ee3d01a13d6f7fd3516ce58e43ce7f6d7dbc0f6b8cc90b26d1be13b2b5b39ce76c29be753edbf5146eca92c02de2746f251918ac12a1cf103df1899de
-
Filesize
71KB
MD5d3fcd5038079ef42e23ed39a86af5a31
SHA13977309df5b3ddc0218a800ee463ddcbcae7503e
SHA2569d4ab0418d94d3c3d7025ecc1c70ce1762ee12aaa4d35666c2dc7887df53a537
SHA5128535e4b5b7b61cf31fe69bd43eb2ba4c2a248a2f2a6efcf9b1ffc9cf4d39b67dcb687d45964054b3900f5aa21662b4acc91302f02e99e819ac6f5827a0d493d0
-
Filesize
678KB
MD56aba9f00d64371b940eedc21804ea9eb
SHA15fb0e520a23c780474b0866218c61ff55d083b3f
SHA25622c949720dacd2dc19b7744185b18faf53dc18199c36af44158257a08ce7f3fd
SHA5129166ff3cfd7adc334f3a98f4a40736c178a1c793f6ca264722bd1b962a3d059d88035eee1f45aab2b45a8692a13ef50c8e762c4c8600937b263fd7c2703185c0
-
Filesize
43KB
MD59b5e37f89268ccce0e098222004093ad
SHA130b12174abda6a420b2cc152b5c682ff8f106c37
SHA256fe068b6f15a5423f86558927dd22ec35070c041db9cde1ecade0590d93ca5285
SHA51223e8cbaa6103f5a76729ee8470b5b208d67be22c9b9fa78340055ac8ded04dc6147c8c50cde96f7c10b111f81cab3e5504227ac5b8f1a616c1a1384c6350257f
-
Filesize
918KB
MD5fb1e8eee84791cc015e043ab0ce32bba
SHA142fb789011213635a7d022ba4fd5461a0d9a134d
SHA2560de72da4bc2d16d39c30368af880d754fa0bd9745897652ba50213e589d265c5
SHA512748af415c875cd5d44f305cf58060e7e66ef2ef041b6e86e3a76287a51af63116096eaed0877dc48c17da6594ad0c8dbf0ecadecb763dd469be8b6cc1d02d4a0
-
Filesize
274KB
MD56d6292bc8e698e53e69556add6f62442
SHA1fab26eb07adab421797689da27ad754aa1c31810
SHA2560f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772
SHA512f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32
-
Filesize
517KB
MD527c2b96dfbebba578638588d2c95705f
SHA16223920526982da59a93ccb2d733e9bdbb1afbaf
SHA256a74414ee5a23d73d879c216d9cfd96a9a8ad048773fe689d8a8b3022c9869cdf
SHA512aa90ef4fef936a43c3413c90427668b7956742bb88eb2693d8dc23654952997771e702f5c0b8ffa04e8f0ef8e16809d8bb3ac1f007bc9989b039e78a1d2a6358
-
Filesize
510KB
MD5c3c04754418382f505cafc18d64427f5
SHA1cac5e36dc498d6bb16170020be021ff5bd18a9e2
SHA256df8ec2e0245829ddec5b79f1918c3ae3a3fa540a5a0e3c410e2b6ef0bebc7927
SHA512bda5efd0f69a9c7198841e5d31744fa2bebb05cedb1e2846a0d2dbce6c3193da69c181be1116f38cd5f3d61b441567b1da2c844522184323e3d429294aa91ab5
-
Filesize
80KB
MD570e207da89961cd32217eabbe3ac0791
SHA1305ba309e762a128ae098e5bf0241ba71f3a331e
SHA25683f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9
SHA5128d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075
-
Filesize
34KB
MD5358e21f82feabac03af75599b09532bd
SHA1b6523b40151fa7090d1a2c44f2b7335170b2d7aa
SHA256ba011053d673579f781de553994366683d7ea57410ae8d10d9823387ee94b918
SHA5127334c3b0dcddd321f9fa0536b5000151a4b65f7da5b41e1f70009af7cfdaee70c44d07ce4d5f7eded97d30a89b9c1bb71a18e39fc6243b0fc07a5e3ee05dd1d9
-
Filesize
21KB
MD588e74301f491db06cf075502629b6e56
SHA121e970cd1a672fc00eba203ec52a7e4bcb972420
SHA256e33b1f7ef345a2fde88b2f70e24f1df739c4db0d33f4c2a6fdbacbc4e4190e91
SHA5120efd79562d68912d6526d570be6a9334cbc79df0c68c105b7287ff6f36b5b6c85a7eb99ba8d6b057e86333c0e8909fe50fe49fe42f2c717f10801a88609c4ecd
-
Filesize
25KB
MD5155e691e9ff9b79b713836b5d469e3b9
SHA117988767d56448bfde33c20d1cd46089ce1f2852
SHA256680a6a746f6961b6df5495d91c44bb4007c62090dd76948c45640ed01c0bd56e
SHA512e8ad235a5a847a9da3bfc476e44f3cbf7d5c400e6b63c2ce3fce15d2ce7c39a0ae5b9cb13680a9ecc4c36c529f865fdc3351a1dcee37a36902d132f829b908a7
-
Filesize
282KB
MD5d5d297629e1b1e77758f4221d1a5bf66
SHA15a56ec678d97ea260dbd40825cd1148332a8e06a
SHA256c046865c41a0880ccd223c57e148a1083e7e2fe4da647fa15a04a3dc182da5ae
SHA5128cea7bbea5734f9a6054314235be4047fa51408b51e171f94f7a727520efd13e47f1fe0476d2cabcf946d51a6c17ab3cba4f2eb4263e6ff6891e3024eb9fccc7
-
Filesize
43KB
MD5efc2bbca9bfe174475d17e62ea0f5b4d
SHA13d74ba1d65245fe86cbca4cff525856e9b1755a1
SHA2569f025d34cb7dc817df9f7f722c14eff6f2d95946ef24c486c7063d8ce9e0236f
SHA512575a9700ea8d4fa1d470632c3654425c816b82c7a5f60c8c9787cc699961d95b2eee82ebedceaa77ec17a96329958235b3a94b6ee868e3a900bcae770506ef23
-
Filesize
54KB
MD5580244bc805220253a87196913eb3e5e
SHA1ce6c4c18cf638f980905b9cb6710ee1fa73bb397
SHA25693fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
SHA5122666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
-
Filesize
1007KB
MD596a320c552ce1152cd674895ffad9f10
SHA17a345edab598a794d71d03cd36b78e1ce683e5c5
SHA256fcadc89d8b2154008f96073da5562575c054e5520f8cd1ff5e292ffe7e67efd7
SHA512465032415e03c4eb27eb07c157139962d1a3f04619b4bc989bbc1455a62fb5491e7915ac5df9be83c3b17f7287086ab0de0d4caf0cb161f857f3eff05ff776dc
-
Filesize
2.6MB
MD5253ba7f0427e3f8e032b97496a019a24
SHA162793783943b04d8836746bb452145722cf63001
SHA256814eb85113211fa90efe952f35d06e537f01bf38febca48e2c0cef02ebdb1877
SHA51229f848f4293454a0103197cd3bb59e364df099b7a26f926673b30132ffe3d15b505fbfc3e0391482d9cd9ed53efd0f3193d0cdf83e0fb59ce3e27de878b83585
-
Filesize
628KB
MD5b8cd6b3141a11fa161b2039ded9dc0f1
SHA1bdf56b2b8b84940699034a2afd9be6fca554d905
SHA256c82a13255716c73b3ed9d89c48eb000d556e9690f4f830d444ffb64041f7e813
SHA512deba05e0c5e077aba1b17985863abdbe115d7f9476a2902d6ddbed081b7632b79510601561276354516350553913d162333842a1e896af8af5b1dd5bc2c00b4f
-
Filesize
14KB
MD5727dbdbe573b1ef41a2c2457d9d1b9a4
SHA1b65d0ead80c87f7e4b6543c362c257185d5e33c3
SHA256fe204d16f31a6b210343be7e52279f8abedf8587206503daa6f2c8f6224679f2
SHA5120b1530ca35d6772da20ef7018bd1f81554d9e2f1b9f30ea12db5c40f7f800712c88caa77b3df29e503ebd40b33d06cc16125eadab7804f974d659b2f6c577681
-
Filesize
54KB
MD5595efdf47d3a392ec489defac02ad7cb
SHA140741f2a47c5f1f210f860c10fac7bedc4eb058d
SHA2569fac7662c10a44f9870f42e1a5d407b31b0d7e4428b7ca95c28bc705625d0613
SHA512a7c5bde085b6d9465cf01798631381e3eb73b9b93db8d06bb7ab7c759bef1a92fe8174b6faf2bfcc7b300d0c242bab2adc90c488ab36d257bbc34d56e8d41bcf
-
Filesize
21KB
MD55f32cd5a2c08ec5504de906c6f598281
SHA17adafa9de45c29b0e58c7df98f1c756ebf05dcb2
SHA256f54ef6da320b5f66f3562e44a36bf0cea3848d452ebe2b53f7f5dbb28cd2b61b
SHA512f3f9affc5157a1ac09eea0f2075184d5649dcd8e49c888ead27e633faf543e30d4085997c0af0942398f64b3ef2a62a8a37028efcfa30b77f491e2d34fe34b72
-
Filesize
2.8MB
MD531aafa3933fdab7683e889ec1038ad35
SHA1d11f7fa55e2cf75ebbc6487468ed4b0674f1111d
SHA25624aa9269afbac24251495bd0c86538b814089cdaa0aa77a2ef653d31dbc33bcd
SHA512e63ef239f6f58692f8b5c1fe4dd60e91f2892da696b8797437e4cbc6b7bddfeb0dbaaccee0be0185e50e05162b5cc141ee14da9aa153f26252bc7461d8da2da1
-
Filesize
19KB
MD5a5b3e031c0d6b20817422beb12bfc78f
SHA1e9a909e13889a2e6688782d3a290ac375ba4b528
SHA256c66c8d3ae5f3af64ee34da2f7df88055e314fa1e9254aa9e2425e1f527db9e81
SHA512f96ad64a771767bb626de49786f5adc4e94a56fa10f68588b9af06ae33dc2f73fade1fc9758ecbefd56a94a6a6221392addb6b9a2b1295f8f39940d7e760a509
-
Filesize
20KB
MD52e27ddbcd452e61fe204dc593e1846ff
SHA1005a864ba1c68802218cfba31756a62193a3407e
SHA256ef736367bc542ca05bc3ca14455934b412a3f88564d022bb14c59f82d0433ba2
SHA5124bc127d9e21667b113df85f4beda96c00d1a5933c9f25d65ec6084b7efdec58500404eb394f648a5cfbbf50c4e32af0306686f978a09ad0f6a3212427b0ffcff
-
Filesize
405KB
MD58b6269e7ca2180ffd4777552f2335760
SHA1c809c7c37db0d73662f1034d6dfea63a7db0b229
SHA2568c0d48a0383af350f80c2dadd34e67bb8c0e2b4186871e59178715f0c4aa4d54
SHA51237c4323b10d663cad2c0869000dcfd47cc61a74c8e4fe2aeb5029e3d64a3301b3a32b32177aae382ecc3c2e68dc677ee362563eb305ac5003a688017db1d327f
-
Filesize
399KB
MD5152544f1ffd1a61aadeb23fdf4078b0d
SHA1f3a65b9def674f4e139dcd92766e9df7280188b1
SHA256bac443cf632829f3a946d79f35fe75fa6648949b7cc9b51ec7197691a3b84eee
SHA512520da08cec73947a8cb66d2e4e70c3e5f2a5ab230d8cae95f9ea60961878166151ab5053fbfc11a2441680bad7b21e7c1222ff89a68c7e1d5a06d248b0c16388
-
Filesize
39KB
MD5307e0f115911e72fb3515cd3e974b802
SHA123c392e92714df39f50411abc74210f973f13891
SHA256e4b01417828da0489b97f1a6e3173b501cc510a1c14e5536f65b6f5929dc24e1
SHA512cd8c9eb1068a7c0ca1c015575a71efaeb4a2a51f00003f011e6a00e862bf11d8f51632f97d2a351d17ad707b35a2b01d63beaea45176f3a87b28450a211e456d
-
Filesize
28KB
MD5d73970251dd27aab5d6bfb79b98e672f
SHA148e90e2224b492d4b3356b669614806f9bbaeff7
SHA2563051a1f1cd8c2984d56656fc7cda2bc63b57735dcf1a56c39a1d77e6196d3d38
SHA5125e6e7b40d5cc93aa12782974a6e19c5d8c28a05dc32195b0d1f6ff28f976bdfb79075aa8cc3cd22c760ba5ce611f8dfc0f99ff0509545510fd21da649cdab331
-
Filesize
1.4MB
MD5c4fa0302349ea02d1a86e8c3538441a4
SHA1830cd230e1b53cc0b6eda814ddd8b1851b94e475
SHA2562c5b663d664e3e5fe58a27bf5148a35770f096005df2069af859fb2d4ce6959b
SHA512cf9fa52e7bf8f239b746d6a3cc95315dca89e00029e8a32c0b6372b11386a6805b7a47f09e56c85f24c8e2329e4cf54fb004a7509303b926ddbe27022d9b6bfc
-
Filesize
58KB
MD54cec7a3155b93a82f1171e1b4a27ba44
SHA1d3279fe76c74f30ff4a44e62383e2f67884e4fd9
SHA256a1c433464b65db673ce7228aba3788a16f850cf4813e389f989b6fe04f1fc1af
SHA5126e9efddfdcb68c0364605042e061845f3df6971328b12c6284e818549c54ddabd0fc7581ed5fe88aed239b58c5f24c6814681fbe3b70957e8f5134c6d09b234b
-
Filesize
897B
MD59ef365494bc362da1a6ddf86acc48b7a
SHA1e466a6fcd0e8bcfe9a4657e113d81be7a70092e8
SHA2566f9dd8f4ce48574ce886f3ebd30cead17aafcab6defeccba45ff1348ffa6c8a7
SHA5129628a120f96d29820a8ee9a39f11579bb2edf0504a76169bbaddba2692fd54a007d8b57f73633c3bca39e32c132cb1ded0374851f5ff5b6107f8d2642ccb2bab
-
Filesize
112KB
-
Filesize
2.6MB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
1.0MB
-
Filesize
32KB
-
Filesize
24KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
3.3MB
-
Filesize
72KB
-
Filesize
944KB
-
Filesize
80KB
-
Filesize
96KB
-
Filesize
40KB
-
Filesize
544KB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
400KB
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
704KB
-
Filesize
296KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
536KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
16.2MB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
7.7MB