Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 01:06
Behavioral task
behavioral1
Sample
f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe
Resource
win7-20240903-en
General
-
Target
f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe
-
Size
981KB
-
MD5
b02859003f6b038c81cbac25f1b47c4e
-
SHA1
372b069847f547e80827ca54f739e1b521e64163
-
SHA256
f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768
-
SHA512
41123fb211f3936f07dbc3c5fe5cd86195b734f7e7ab35c61706a7d127057124b00f0dfa478a1e85158fdb007adb65993dd699ec87cc735d56f57b489ce5a300
-
SSDEEP
24576:FGq4MROxnFi37ssrrcI0AilFEvxHProo0B:FuMiogsrrcI0AilFEvxHPO
Malware Config
Extracted
orcus
192.168.56.1:6969
cdcfb8e01bd24ecf81196eacf6c2613f
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
minecraft(aimbot)
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b7d-22.dat family_orcus -
Orcurs Rat Executable 2 IoCs
resource yara_rule behavioral2/memory/2808-1-0x0000000000CD0000-0x0000000000DCC000-memory.dmp orcus behavioral2/files/0x000a000000023b7d-22.dat orcus -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Orcus.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation OrcusWatchdog.exe -
Executes dropped EXE 4 IoCs
pid Process 2060 Orcus.exe 1392 Orcus.exe 1788 OrcusWatchdog.exe 1432 OrcusWatchdog.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Orcus\Orcus.exe f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Orcus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Orcus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OrcusWatchdog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OrcusWatchdog.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 Orcus.exe 2060 Orcus.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 1432 OrcusWatchdog.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe 1432 OrcusWatchdog.exe 2060 Orcus.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2060 Orcus.exe Token: SeDebugPrivilege 1788 OrcusWatchdog.exe Token: SeDebugPrivilege 1432 OrcusWatchdog.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2060 Orcus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2060 Orcus.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2060 2808 f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe 84 PID 2808 wrote to memory of 2060 2808 f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe 84 PID 2808 wrote to memory of 2060 2808 f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe 84 PID 2060 wrote to memory of 1788 2060 Orcus.exe 87 PID 2060 wrote to memory of 1788 2060 Orcus.exe 87 PID 2060 wrote to memory of 1788 2060 Orcus.exe 87 PID 1788 wrote to memory of 1432 1788 OrcusWatchdog.exe 88 PID 1788 wrote to memory of 1432 1788 OrcusWatchdog.exe 88 PID 1788 wrote to memory of 1432 1788 OrcusWatchdog.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe"C:\Users\Admin\AppData\Local\Temp\f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe"C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2060 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe"C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2060 "/protectFile"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
-
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
981KB
MD5b02859003f6b038c81cbac25f1b47c4e
SHA1372b069847f547e80827ca54f739e1b521e64163
SHA256f38fc16a733ab3d1946f4b3e73ad2ba96539c8168081aa00512b03dff85df768
SHA51241123fb211f3936f07dbc3c5fe5cd86195b734f7e7ab35c61706a7d127057124b00f0dfa478a1e85158fdb007adb65993dd699ec87cc735d56f57b489ce5a300
-
Filesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
Filesize
1KB
MD5b60f2465989d7198a4494c14c2e6dd65
SHA1cdd3e08ca199327e84e04e9689aff7c5e7f70f52
SHA2569d1e40da70d3188237bd8145480b2a133ab214e98f37162ec18653cef5825d51
SHA512ca8b868a3f5e0ae94d20ee62bd5cae5fd0a31c73d1864732c5a921efeddb8077bdee00001e79ce5df0ddfc4ae3f0456fc53be92f60b3b366f2aeb4c3e6635bb3