Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2025, 01:07

General

  • Target

    a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe

  • Size

    3.0MB

  • MD5

    62b979701e8d5ff4c7c49af4c4b69dca

  • SHA1

    ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed

  • SHA256

    a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c

  • SHA512

    d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6

  • SSDEEP

    49152:ys7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:ysHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

packlab

C2

31.44.184.52:50079

Mutex

sudo_ld91xbpc2kl6yn2iq5m7rnm9wlvhevm0

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\geoprivateline\wpwordpress.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

  • Orcus family
  • Orcus main payload 1 IoCs
  • Orcurs Rat Executable 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe
    "C:\Users\Admin\AppData\Local\Temp\a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
      "C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        3⤵
          PID:1292
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2416
    • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
      C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
    • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
      C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        2⤵
          PID:3284
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
          2⤵
            PID:232
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
            2⤵
              PID:4928
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5076
          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1980
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2772
          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3912
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2656
          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2168
          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3960
          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:732

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\caspol.exe.log

            Filesize

            1KB

            MD5

            0672db2ef13237d5cb85075ff4915942

            SHA1

            ad8b4d3eb5e40791c47d48b22e273486f25f663f

            SHA256

            0a933408890369b5a178f9c30aa93d2c94f425650815cf8e8310de4e90a3b519

            SHA512

            84ad10ba5b695567d33a52f786405a5544aa49d8d23631ba9edf3afa877c5dbd81570d15bcf74bce5d9fb1afad2117d0a4ef913b396c0d923afefe615619c84b

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wpwordpress.exe.log

            Filesize

            1KB

            MD5

            663b8d5469caa4489d463aa9bc18124f

            SHA1

            e57123a7d969115853ea631a3b33826335025d28

            SHA256

            7b4fa505452f0b8ac74bb31f5a03b13342836318018fb18d224ae2ff11b1a7e8

            SHA512

            45e373295125a629fcc0b19609608d969c9106514918bfac5d6b8e340e407434577b825741b8fa6a043c8f3f5c1a030ba8857da5f4e8ef15a551ce3c5fe03b55

          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe

            Filesize

            3.0MB

            MD5

            62b979701e8d5ff4c7c49af4c4b69dca

            SHA1

            ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed

            SHA256

            a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c

            SHA512

            d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6

          • C:\Users\Admin\AppData\Roaming\geoprivateline\wpwordpress.exe.config

            Filesize

            357B

            MD5

            a2b76cea3a59fa9af5ea21ff68139c98

            SHA1

            35d76475e6a54c168f536e30206578babff58274

            SHA256

            f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

            SHA512

            b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

          • memory/1812-48-0x0000000006750000-0x000000000675A000-memory.dmp

            Filesize

            40KB

          • memory/1812-47-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

            Filesize

            64KB

          • memory/1812-46-0x0000000005A90000-0x0000000005AA8000-memory.dmp

            Filesize

            96KB

          • memory/2536-29-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/2536-39-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/2536-35-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

            Filesize

            72KB

          • memory/2536-33-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/2736-25-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/2736-24-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/2736-26-0x00000000054F0000-0x0000000005502000-memory.dmp

            Filesize

            72KB

          • memory/2736-27-0x00000000061A0000-0x00000000061EE000-memory.dmp

            Filesize

            312KB

          • memory/2736-30-0x0000000006450000-0x00000000064EC000-memory.dmp

            Filesize

            624KB

          • memory/2736-34-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/3852-23-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/3852-0-0x000000007545E000-0x000000007545F000-memory.dmp

            Filesize

            4KB

          • memory/3852-7-0x0000000006070000-0x0000000006082000-memory.dmp

            Filesize

            72KB

          • memory/3852-6-0x0000000006090000-0x0000000006122000-memory.dmp

            Filesize

            584KB

          • memory/3852-5-0x00000000065A0000-0x0000000006B44000-memory.dmp

            Filesize

            5.6MB

          • memory/3852-4-0x0000000005EB0000-0x0000000005F0C000-memory.dmp

            Filesize

            368KB

          • memory/3852-3-0x0000000075450000-0x0000000075C00000-memory.dmp

            Filesize

            7.7MB

          • memory/3852-2-0x0000000005C30000-0x0000000005C3E000-memory.dmp

            Filesize

            56KB

          • memory/3852-1-0x0000000000FE0000-0x00000000012DE000-memory.dmp

            Filesize

            3.0MB