Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 01:10
General
-
Target
b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970.exe
-
Size
2.9MB
-
MD5
1249e9396c0db740782bf81f4df9af36
-
SHA1
9115861b4181e12ea6a2974df2beb8b06f91ef76
-
SHA256
b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970
-
SHA512
ab355529fc66b99d0521a013e062a17ffb6017e17ec67efa570d8080938a6b2540475058f8035a1b01179e593e1ff808e6116bde2b9ab44012e06576c031c1f9
-
SSDEEP
49152:NXmN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmlWncFf0I74gu3Ts:NS0wGGzBjryX82uypSb9ndo9JCm
Malware Config
Extracted
orcus
192.168.50.155:10134
orcus_rat_______874d7e7d129c4b8594f95e8c03299577_1488_1488_1488_freeeeeee_robux
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Orcurs Rat Executable 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970.exe"C:\Users\Admin\AppData\Local\Temp\b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.0MB
-
Filesize
368KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
10.8MB