Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
30/01/2025, 13:26
General
- Target Update.exe
- Size 3.0MB
- Sample250130-qppxaaslax
- SHA256 7e7f54be771fd2aa38fe215442508a4673163aa87f39eabb7c6cf9de77d1546d
Malware Config
Extracted
-
orcus
-
dc.deenote4396.com:10134
-
3749f50e4c6b4cbfb5eac93f5e5530bb
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Lenovo\Update.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Lenovo
-
watchdog_path
AppData\Lenovo.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus family
- Orcus main payload 1 IoCs
- Orcurs Rat Executable 2 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update.exe"C:\Users\Admin\AppData\Local\Temp\Update.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hntladlm.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8BD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD8BC.tmp"3⤵
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Program Files\Lenovo\Update.exe"C:\Program Files\Lenovo\Update.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Lenovo.exe"C:\Users\Admin\AppData\Roaming\Lenovo.exe" /launchSelfAndExit "C:\Program Files\Lenovo\Update.exe" 644 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Lenovo.exe"C:\Users\Admin\AppData\Roaming\Lenovo.exe" /watchProcess "C:\Program Files\Lenovo\Update.exe" 644 "/protectFile"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Lenovo\Update.exe"C:\Program Files\Lenovo\Update.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Update.exe
Lenovo.exe.log
RESD8BD.tmp
hntladlm.dll
Lenovo.exe
WindowsInput.exe
WindowsInput.exe.config
CSCD8BC.tmp
hntladlm.0.cs
hntladlm.cmdline
memory/644-67-0x000000001C420000-0x000000001C430000-memory.dmp
memory/644-66-0x000000001C660000-0x000000001C822000-memory.dmp
memory/644-65-0x000000001C2F0000-0x000000001C308000-memory.dmp
memory/644-63-0x000000001BC10000-0x000000001BC5E000-memory.dmp
memory/644-62-0x0000000000CB0000-0x0000000000FAE000-memory.dmp
memory/984-46-0x000000001ACE0000-0x000000001ADEA000-memory.dmp
memory/2212-81-0x00000000008F0000-0x00000000008F8000-memory.dmp
memory/3504-23-0x000000001CD40000-0x000000001CD52000-memory.dmp
memory/3504-21-0x000000001CD60000-0x000000001CD76000-memory.dmp
memory/3504-1-0x00007FFEBFD20000-0x00007FFEC06C1000-memory.dmp
memory/3504-2-0x000000001BDF0000-0x000000001BE4C000-memory.dmp
memory/3504-4-0x00007FFEBFD20000-0x00007FFEC06C1000-memory.dmp
memory/3504-6-0x000000001CC80000-0x000000001CD1C000-memory.dmp
memory/3504-5-0x000000001C7B0000-0x000000001CC7E000-memory.dmp
memory/3504-3-0x0000000001AE0000-0x0000000001AEE000-memory.dmp
memory/3504-61-0x00007FFEBFD20000-0x00007FFEC06C1000-memory.dmp
memory/3504-24-0x000000001D2A0000-0x000000001D2C0000-memory.dmp
memory/3504-0-0x00007FFEBFFD5000-0x00007FFEBFFD6000-memory.dmp
memory/4524-19-0x00007FFEBFD20000-0x00007FFEC06C1000-memory.dmp
memory/4524-16-0x00007FFEBFD20000-0x00007FFEC06C1000-memory.dmp
memory/4920-41-0x0000000002E40000-0x0000000002E7C000-memory.dmp
memory/4920-40-0x00000000012B0000-0x00000000012C2000-memory.dmp
memory/4920-39-0x00007FFEBD0E3000-0x00007FFEBD0E5000-memory.dmp
memory/4920-38-0x0000000000AE0000-0x0000000000AEC000-memory.dmp