5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/12/2024, 22:33

Target
Orcus RAT.rar
Size 19.0MB
Sample241216-2gnj2askaz
SHA256 5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3
MD5 95a7746090144dc426034bad7607b0cb
SHA1 ca2657264f6a151fc5c8f3a1855850a03fbf19b8
SHA512 1e235c9a15aefb7ddc392c2836d3b7654723f602ff6ba4e98df16057a212813517733d32af43da07fb9d1f5af4d21c987efed6391e51413a83e6553e6ece5749
SSDEEP 393216:e22NGiEPwMcIurI/hL2O9tMiP9WkmsdK+yW6yPbiFc2xF4c08jkbb:V2o34tI5q520mn6yV+4c0bbb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 4 IoCs

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of FindShellTrayWindow 7 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Orcus RAT.rar"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\7zO87989447\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87989447\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\7zO879FB087\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO879FB087\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\7zO879AD7C7\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO879AD7C7\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2732

Orcus.Administration.exe

Path \Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe
Size 265KB
SHA256 0d5a4541da4b8a9613fea8c160596ad697580c8f5f72e4e2a5245f58e67e7803
MD5 1f47b14658e28812b452ba2059df1610
SHA1 5cd43eb9f52093b3d27f6d41d016bb9bddd9bdf9
SHA512 2a26eaf4757a938a5335f5a5164a30aba3eae10d682ba2d6c5df934288ecfa5ca20672205c86093c33aab7288e0ca40d18606761237ab9178bdc65e13165b807
SSDEEP 3072:w6DhOHYMjlkvuk/1AdNR6LWuoQztlPnnAl4i/b1UNNLf+a79:wBKqf6LJTrAl4i/pUNNLf+
MD5 SHA1 SHA512 SSDEEP

Submit Download