Resubmissions

13-11-2024 08:48

241113-kqly5ayfmm 10

13-11-2024 08:46

241113-kpsqaa1rfr 10

Analysis

  • max time kernel
    34s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 08:46

General

  • Target

    yef.exe

  • Size

    1.2MB

  • MD5

    58991bbcf8a974e128ba64f3bcb31e6e

  • SHA1

    645a5096283c1f0b63ff07f3927534e44804114d

  • SHA256

    d05f328df78420b8d97cb7205cccee30617ebeff333ac8d5ed32f6da69563baa

  • SHA512

    76c35a2b6b787ded9c049b189b8844019720f47c0f2e07ced1c9b9b7622382d50062770f222ad1a0a626e66498be3d3e6cc22ca9c7fbf72d3b29b7f59e881eb6

  • SSDEEP

    24576:rwVTXJvatkjAE+k/7aygMpbUdtoQVj020iDqxJooLUcdJYRk:KTQujL+hMyhVj8y8J7UcG

Malware Config

Extracted

Family

orcus

Botnet

cuties

C2

5virginia-evil.gl.at.ply.gg

Mutex

c75fa2addeaf42abb9797c0d693eca2b

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    10/27/2024 02:14:09

  • plugins

    AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNwA2ADkAMwA2AGQAMQAzAGMAYQAwAGMANAA5ADQANgA5AGIAMgBkAGUAOAA5ADQAMAAxADkANABiAGEAMAAzAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDAAYQA4ADAANgA5AGMAZAA2AGUAMwA1ADQANAA1ADQAYQBkADMAOAAwAGQANABjAGIAYQA4ADYANQA2ADAANwABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIDQAZAA0ADEAYQAwADEAMgBkADgAMwBlADQAOABmADQAYQAxADEAYQBiAGYAYwA3ADMAMQBkADIAOQAwAGEAYwACAAYG

  • reconnect_delay

    10000

  • registry_autostart_keyname

    cmd

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\yef.exe
    "C:\Users\Admin\AppData\Local\Temp\yef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3244
    • C:\Users\Admin\AppData\Local\Temp\yef.exe
      #cmd
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3624
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:668
        • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
          #cmd
          4⤵
          • Executes dropped EXE
          PID:4340
        • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
          #cmd
          4⤵
          • Executes dropped EXE
          PID:3680
        • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
          #cmd
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    fb1df442f2cee34456c6ed9064318559

    SHA1

    729e8f61f181b303d25e1f709399db242d82c6c2

    SHA256

    75207b26127c0778928b2c0ce51d371a1b4f5a4c47596902f88dbff9ddd16a79

    SHA512

    d6df1b8e17733d65ae332d20a22fcbc2cdec8df38a705b694b4d87b2f0c9c287378791c3da2cb2142e95f31df1b4209e01a17a83eabfcb2175f38a9207ad0294

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yef.exe.log

    Filesize

    321B

    MD5

    baf5d1398fdb79e947b60fe51e45397f

    SHA1

    49e7b8389f47b93509d621b8030b75e96bb577af

    SHA256

    10c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8

    SHA512

    b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    d46db50f2af614023ab1167a03479c48

    SHA1

    9da855378a77a4b4c73dbb5e1edab5c36a3ba36c

    SHA256

    38c2fedf6a94c82552be3169e62da9767604e0bcdaf3b40ddc507d527b17f739

    SHA512

    2fe4a40b87143c09e74710adf67661a0a2b05aa87a0f94fb06fbde1904997bc807a5dc0a8a78c06f6915c2ce7c35842b30c1b4c0461f81e4fd073ab0be881c74

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khjzseo2.bh4.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\GamerView\sqlite3.dll

    Filesize

    626KB

    MD5

    d8aec01ff14e3e7ad43a4b71e30482e4

    SHA1

    e3015f56f17d845ec7eef11d41bbbc28cc16d096

    SHA256

    da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e

    SHA512

    f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe

    Filesize

    1.2MB

    MD5

    58991bbcf8a974e128ba64f3bcb31e6e

    SHA1

    645a5096283c1f0b63ff07f3927534e44804114d

    SHA256

    d05f328df78420b8d97cb7205cccee30617ebeff333ac8d5ed32f6da69563baa

    SHA512

    76c35a2b6b787ded9c049b189b8844019720f47c0f2e07ced1c9b9b7622382d50062770f222ad1a0a626e66498be3d3e6cc22ca9c7fbf72d3b29b7f59e881eb6

  • memory/212-117-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/212-77-0x0000000006420000-0x000000000642A000-memory.dmp

    Filesize

    40KB

  • memory/212-69-0x0000000005730000-0x0000000005740000-memory.dmp

    Filesize

    64KB

  • memory/212-68-0x0000000005D80000-0x0000000005F42000-memory.dmp

    Filesize

    1.8MB

  • memory/668-94-0x0000000070D20000-0x0000000070D6C000-memory.dmp

    Filesize

    304KB

  • memory/3244-39-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

    Filesize

    304KB

  • memory/3244-15-0x0000000004FC0000-0x0000000005026000-memory.dmp

    Filesize

    408KB

  • memory/3244-13-0x0000000004D00000-0x0000000004D22000-memory.dmp

    Filesize

    136KB

  • memory/3244-16-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3244-116-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3244-4-0x0000000002480000-0x00000000024B6000-memory.dmp

    Filesize

    216KB

  • memory/3244-110-0x0000000007430000-0x0000000007452000-memory.dmp

    Filesize

    136KB

  • memory/3244-109-0x00000000073F0000-0x00000000073F8000-memory.dmp

    Filesize

    32KB

  • memory/3244-108-0x0000000007410000-0x000000000742A000-memory.dmp

    Filesize

    104KB

  • memory/3244-36-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3244-107-0x0000000007310000-0x0000000007324000-memory.dmp

    Filesize

    80KB

  • memory/3244-14-0x0000000004EA0000-0x0000000004F06000-memory.dmp

    Filesize

    408KB

  • memory/3244-24-0x0000000005890000-0x0000000005BE4000-memory.dmp

    Filesize

    3.3MB

  • memory/3244-78-0x0000000006D60000-0x0000000006D92000-memory.dmp

    Filesize

    200KB

  • memory/3244-106-0x0000000007300000-0x000000000730E000-memory.dmp

    Filesize

    56KB

  • memory/3244-38-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

    Filesize

    120KB

  • memory/3244-105-0x00000000072D0000-0x00000000072E1000-memory.dmp

    Filesize

    68KB

  • memory/3244-5-0x0000000005260000-0x0000000005888000-memory.dmp

    Filesize

    6.2MB

  • memory/3244-95-0x0000000007350000-0x00000000073E6000-memory.dmp

    Filesize

    600KB

  • memory/3244-93-0x0000000007140000-0x000000000714A000-memory.dmp

    Filesize

    40KB

  • memory/3244-91-0x0000000007720000-0x0000000007D9A000-memory.dmp

    Filesize

    6.5MB

  • memory/3244-92-0x00000000070D0000-0x00000000070EA000-memory.dmp

    Filesize

    104KB

  • memory/3244-11-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3244-89-0x0000000006380000-0x000000000639E000-memory.dmp

    Filesize

    120KB

  • memory/3244-90-0x0000000006DA0000-0x0000000006E43000-memory.dmp

    Filesize

    652KB

  • memory/3244-79-0x0000000070D20000-0x0000000070D6C000-memory.dmp

    Filesize

    304KB

  • memory/3452-26-0x0000000005960000-0x0000000005968000-memory.dmp

    Filesize

    32KB

  • memory/3452-37-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3452-22-0x0000000005990000-0x0000000005A22000-memory.dmp

    Filesize

    584KB

  • memory/3452-6-0x0000000000400000-0x0000000000534000-memory.dmp

    Filesize

    1.2MB

  • memory/3452-50-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3452-12-0x0000000002E20000-0x0000000002E2A000-memory.dmp

    Filesize

    40KB

  • memory/3452-23-0x00000000058F0000-0x000000000593C000-memory.dmp

    Filesize

    304KB

  • memory/3452-25-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/3452-27-0x0000000005980000-0x0000000005988000-memory.dmp

    Filesize

    32KB

  • memory/3452-35-0x0000000005B10000-0x0000000005B5E000-memory.dmp

    Filesize

    312KB

  • memory/3452-28-0x0000000005A30000-0x0000000005AE8000-memory.dmp

    Filesize

    736KB

  • memory/4608-8-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/4608-0-0x00000000750AE000-0x00000000750AF000-memory.dmp

    Filesize

    4KB

  • memory/4608-2-0x0000000005EB0000-0x0000000006454000-memory.dmp

    Filesize

    5.6MB

  • memory/4608-10-0x00000000750A0000-0x0000000075850000-memory.dmp

    Filesize

    7.7MB

  • memory/4608-1-0x0000000000EE0000-0x0000000001016000-memory.dmp

    Filesize

    1.2MB