Analysis
-
max time kernel
112s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 20:11
General
-
Target
sfgsegesg.exe
-
Size
840KB
-
MD5
9962f7e10a4120a238ca43d010b0b532
-
SHA1
60ca3f4542467a99c3ed56808316322cf4d028d8
-
SHA256
5bc3eccc25b7a8b566200307534681641b7097061f9cfd33bf4621025ff8486e
-
SHA512
7461fa22b600fdbcbf2fe38d25aca926a0f04e1bc198d21094db6dbd94e515027c03dfaa49f258b354025e6d0230fa17dbab2b15d8edb283a06eb2229568ce69
-
SSDEEP
24576:A9KS04YNEMuExDiU6E5R9s8xY/2l/dO5Ibt+rY:A9G4auS+UjfU2TQIbt+r
Malware Config
Extracted
orcus
bseg
5email-hitting.gl.at.ply.gg
7016723c73724de18e276dfdfeca772b
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
11/14/2024 21:10:47
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 55 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sfgsegesg.exe"C:\Users\Admin\AppData\Local\Temp\sfgsegesg.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x154 0x4441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD51fc04b8bb4896745163df806695ee193
SHA139174ce2fca9a3e86bb7a5686037bc42f2572de1
SHA2563f2b2fd440fdd84288dadfc63e37a4bc7ea0aae26889ab0d4a5ef6148f44ce14
SHA5123ff18bdd364f27e54ffbf2d1af53e3500ec57e7e8fa14185f7fb1ef6639d69ac6253543b9e2155ade45ca5bcd567e94334f1ee7ad0a7ff28194168dc49883261
-
Filesize
840KB
MD59962f7e10a4120a238ca43d010b0b532
SHA160ca3f4542467a99c3ed56808316322cf4d028d8
SHA2565bc3eccc25b7a8b566200307534681641b7097061f9cfd33bf4621025ff8486e
SHA5127461fa22b600fdbcbf2fe38d25aca926a0f04e1bc198d21094db6dbd94e515027c03dfaa49f258b354025e6d0230fa17dbab2b15d8edb283a06eb2229568ce69
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
312KB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
1.8MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
528KB
-
Filesize
88KB
-
Filesize
48KB
-
Filesize
376KB
-
Filesize
7.7MB
-
Filesize
7.7MB