Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 01:43
Behavioral task
behavioral1
Sample
ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe
Resource
win7-20241010-en
General
-
Target
ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe
-
Size
3.0MB
-
MD5
af31d01a7d0c9277553f874e6f8764ac
-
SHA1
22c88cdc20b1fc0363bc3dadff7642e3588a2ea5
-
SHA256
ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390
-
SHA512
68dc33145c2ac61688a8ec1376cc273d0994d381267dd6943b390539271b5aed0de5c709ad306a39aabdfa2bad274041c95871d28f02aa49f028ebb5151d18c2
-
SSDEEP
49152:RGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:RLHTPJg8z1mKnypSbRxo9JCm
Malware Config
Extracted
orcus
steam
31.44.184.52:22587
sudo_3hywl5z2zo7blkw14tszonq0n5jzd6sh
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\tempeternaldle\asyncgenerator.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral1/files/0x0009000000016ace-10.dat family_orcus -
Orcurs Rat Executable 10 IoCs
resource yara_rule behavioral1/memory/2564-1-0x0000000000CD0000-0x0000000000FCE000-memory.dmp orcus behavioral1/files/0x0009000000016ace-10.dat orcus behavioral1/memory/2500-18-0x00000000000D0000-0x00000000003CE000-memory.dmp orcus behavioral1/memory/2796-32-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2796-44-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2796-46-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2796-29-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/2796-27-0x0000000000400000-0x00000000006FE000-memory.dmp orcus behavioral1/memory/1952-52-0x00000000008E0000-0x0000000000BDE000-memory.dmp orcus behavioral1/memory/1736-54-0x0000000000BE0000-0x0000000000EDE000-memory.dmp orcus -
Executes dropped EXE 4 IoCs
pid Process 2500 asyncgenerator.exe 2924 asyncgenerator.exe 1952 asyncgenerator.exe 1736 asyncgenerator.exe -
Loads dropped DLL 1 IoCs
pid Process 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2500 set thread context of 2796 2500 asyncgenerator.exe 32 PID 2924 set thread context of 3056 2924 asyncgenerator.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncgenerator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncgenerator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msbuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncgenerator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asyncgenerator.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe 2500 asyncgenerator.exe 2500 asyncgenerator.exe 2924 asyncgenerator.exe 2924 asyncgenerator.exe 2796 msbuild.exe 2796 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe Token: SeDebugPrivilege 2500 asyncgenerator.exe Token: SeDebugPrivilege 2924 asyncgenerator.exe Token: SeDebugPrivilege 2796 msbuild.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2500 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe 30 PID 2564 wrote to memory of 2500 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe 30 PID 2564 wrote to memory of 2500 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe 30 PID 2564 wrote to memory of 2500 2564 ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe 30 PID 2188 wrote to memory of 2924 2188 taskeng.exe 33 PID 2188 wrote to memory of 2924 2188 taskeng.exe 33 PID 2188 wrote to memory of 2924 2188 taskeng.exe 33 PID 2188 wrote to memory of 2924 2188 taskeng.exe 33 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2500 wrote to memory of 2796 2500 asyncgenerator.exe 32 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2924 wrote to memory of 3056 2924 asyncgenerator.exe 34 PID 2188 wrote to memory of 1952 2188 taskeng.exe 36 PID 2188 wrote to memory of 1952 2188 taskeng.exe 36 PID 2188 wrote to memory of 1952 2188 taskeng.exe 36 PID 2188 wrote to memory of 1952 2188 taskeng.exe 36 PID 2188 wrote to memory of 1736 2188 taskeng.exe 37 PID 2188 wrote to memory of 1736 2188 taskeng.exe 37 PID 2188 wrote to memory of 1736 2188 taskeng.exe 37 PID 2188 wrote to memory of 1736 2188 taskeng.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe"C:\Users\Admin\AppData\Local\Temp\ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exe"C:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5FDA8EBA-48E2-446B-B471-7D24AFDAEDDF} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exeC:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3056
-
-
-
C:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exeC:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exeC:\Users\Admin\AppData\Roaming\tempeternaldle\asyncgenerator.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
3.0MB
MD5af31d01a7d0c9277553f874e6f8764ac
SHA122c88cdc20b1fc0363bc3dadff7642e3588a2ea5
SHA256ba2d767f8a512a7be3ca0117c2aecd5b89fcba89e42e7b9f8ccac8c6fead0390
SHA51268dc33145c2ac61688a8ec1376cc273d0994d381267dd6943b390539271b5aed0de5c709ad306a39aabdfa2bad274041c95871d28f02aa49f028ebb5151d18c2