5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 22:33

Target

Orcus RAT.rar
Size

19.0MB
MD5

95a7746090144dc426034bad7607b0cb
SHA1

ca2657264f6a151fc5c8f3a1855850a03fbf19b8
SHA256

5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3
SHA512

1e235c9a15aefb7ddc392c2836d3b7654723f602ff6ba4e98df16057a212813517733d32af43da07fb9d1f5af4d21c987efed6391e51413a83e6553e6ece5749
SSDEEP

393216:e22NGiEPwMcIurI/hL2O9tMiP9WkmsdK+yW6yPbiFc2xF4c08jkbb:V2o34tI5q520mn6yV+4c0bbb

Score

7^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 4 IoCs

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of FindShellTrayWindow 7 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2440	2424	7zFM.exe	31
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 2760	2424	7zFM.exe	32
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 3036	2424	7zFM.exe	33
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34
PID 2424 wrote to memory of 2732	2424	7zFM.exe	34

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Orcus RAT.rar"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\7zO87989447\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO87989447\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\7zO879FB087\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO879FB087\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\7zO879AD7C7\Orcus.Administration.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO879AD7C7\Orcus.Administration.exe"
  2⤵
  - Executes dropped EXE
  PID:2732

\Users\Admin\AppData\Local\Temp\7zO87984267\Orcus.Administration.exe

Filesize
265KB

MD5
1f47b14658e28812b452ba2059df1610

SHA1
5cd43eb9f52093b3d27f6d41d016bb9bddd9bdf9

SHA256
0d5a4541da4b8a9613fea8c160596ad697580c8f5f72e4e2a5245f58e67e7803

SHA512
2a26eaf4757a938a5335f5a5164a30aba3eae10d682ba2d6c5df934288ecfa5ca20672205c86093c33aab7288e0ca40d18606761237ab9178bdc65e13165b807

Download Submit