Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 01:12

General

  • Target

    65d04445aa6c76882d4dff12bb2c85c58fb6214410a9a537774ab224d18e73e8.exe

  • Size

    1.2MB

  • MD5

    288bf0fdd34f56af2476c62d8c5ca087

  • SHA1

    8c6e09af2430528f11fc1f09a1c9fd621bcf7ee9

  • SHA256

    65d04445aa6c76882d4dff12bb2c85c58fb6214410a9a537774ab224d18e73e8

  • SHA512

    e3a239f9bb6d8996e9cf36a7c2750ce5e10986b12efea2d2f3467e88996b7e4a92d0876d28e7b8b28af62b2b3e2bd79537efc61fc49f8f069379d45e980f68c6

  • SSDEEP

    24576:gygD3S04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfG2xIbt+rP:gygDt4auS+UjfU2T/5XD5xIbt+r

Malware Config

Extracted

Family

orcus

C2

192.168.0.40

94.4.114.86

Mutex

6e9ecfb4c15b453a88480ef99e4a85be

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    12/02/2024 18:09:31

  • plugins

    AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNwAxADUANQBiAGQAOAA1ADIAZAA3AGEANAAzADkAOABiADEANAA5AGUAYgBjAGIAMQAzADkAZQA2AGIAOABiAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDIANAA3ADIAYgA2AGYANgBhADkANgBjADQAZgA2AGIAOQBhADkAMwBmADQAMABlADgAMwBiAGMAZgA1AGMAMgABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGMANwA5AGEAZQAzADYANAA2ADkANQAyADQAZAA2ADkAOAAzADUAOQA1ADgAZgA4AGIAOQAwADMAYgAxADYAZAACAAYG

  • reconnect_delay

    10000

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65d04445aa6c76882d4dff12bb2c85c58fb6214410a9a537774ab224d18e73e8.exe
    "C:\Users\Admin\AppData\Local\Temp\65d04445aa6c76882d4dff12bb2c85c58fb6214410a9a537774ab224d18e73e8.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioDriver.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioDriver.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\GamerView\sqlite3.dll

    Filesize

    626KB

    MD5

    d8aec01ff14e3e7ad43a4b71e30482e4

    SHA1

    e3015f56f17d845ec7eef11d41bbbc28cc16d096

    SHA256

    da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e

    SHA512

    f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioDriver.exe

    Filesize

    1.2MB

    MD5

    288bf0fdd34f56af2476c62d8c5ca087

    SHA1

    8c6e09af2430528f11fc1f09a1c9fd621bcf7ee9

    SHA256

    65d04445aa6c76882d4dff12bb2c85c58fb6214410a9a537774ab224d18e73e8

    SHA512

    e3a239f9bb6d8996e9cf36a7c2750ce5e10986b12efea2d2f3467e88996b7e4a92d0876d28e7b8b28af62b2b3e2bd79537efc61fc49f8f069379d45e980f68c6

  • memory/1996-31-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1996-30-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/1996-29-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/1996-21-0x00000000006D0000-0x00000000006E0000-memory.dmp

    Filesize

    64KB

  • memory/1996-20-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1996-19-0x0000000000AA0000-0x0000000000BD4000-memory.dmp

    Filesize

    1.2MB

  • memory/1996-18-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/2312-4-0x0000000000BC0000-0x0000000000C0C000-memory.dmp

    Filesize

    304KB

  • memory/2312-16-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2312-10-0x0000000000C10000-0x0000000000C5E000-memory.dmp

    Filesize

    312KB

  • memory/2312-7-0x0000000005020000-0x00000000050D8000-memory.dmp

    Filesize

    736KB

  • memory/2312-6-0x0000000000680000-0x0000000000688000-memory.dmp

    Filesize

    32KB

  • memory/2312-5-0x0000000000620000-0x0000000000628000-memory.dmp

    Filesize

    32KB

  • memory/2312-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

    Filesize

    4KB

  • memory/2312-3-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2312-2-0x00000000003C0000-0x00000000003CA000-memory.dmp

    Filesize

    40KB

  • memory/2312-1-0x0000000001310000-0x0000000001444000-memory.dmp

    Filesize

    1.2MB