Behavioral task
behavioral1
Sample
9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e.exe
Resource
win7-20241023-en
General
-
Target
9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e
-
Size
3.7MB
-
MD5
caaa8fec9e2569e494b423653772ccb4
-
SHA1
c3822270ee1ed555e0cbc5351b9c44ba8e6ba5bb
-
SHA256
9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e
-
SHA512
fb2afc7647aaf2b620c7bc4e195114d4de2e6e46ee2faca9e3d9820fe6e91b3f5fb2282826305380a82da260c0ccd8207a6611936fc5cd29bd13d675a9f02869
-
SSDEEP
49152:vE36D/TG+N8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmTWncFf0I7e:vNbb0wGGzBjryX82uypSb9ndo9JCmU
Malware Config
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e
Files
-
9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e.exe windows:6 windows x64 arch:x64
0d080fb4e0d96bc9e1cf8817d33c28d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RtlLookupFunctionEntry
RtlCaptureContext
OutputDebugStringW
GetFileSizeEx
UnhandledExceptionFilter
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetModuleHandleW
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
GetStdHandle
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
InitializeSListHead
GetConsoleWindow
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
GetModuleHandleA
Sleep
CloseHandle
GetCurrentThreadId
user32
GetClientRect
SetWindowLongPtrA
GetWindowLongPtrA
MoveWindow
SetLayeredWindowAttributes
ShowWindow
GetWindowRect
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??7ios_base@std@@QEBA_NXZ
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord143
ord26
ord27
ord301
ord32
ord33
ord35
ord79
ord30
ord200
ord22
crypt32
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
ws2_32
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
ntohs
htonl
htons
ntohl
gethostname
WSAGetLastError
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
closesocket
recv
send
socket
getsockopt
listen
bind
connect
getpeername
getsockname
ioctlsocket
vcruntime140
strstr
__C_specific_handler
__current_exception
memcmp
memcpy
memmove
memset
__std_exception_copy
_CxxThrowException
memchr
strchr
strrchr
__std_exception_destroy
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__sys_nerr
_c_exit
strerror
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_errno
_register_onexit_function
_exit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
terminate
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
system
_initterm_e
_getpid
_beginthreadex
api-ms-win-crt-string-l1-1-0
strncpy
_strdup
tolower
strpbrk
strcmp
strcspn
isupper
strncmp
strspn
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
_set_new_mode
calloc
free
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
strtoul
atoi
strtol
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__acrt_iob_func
fread
fsetpos
_fseeki64
fwrite
getchar
setvbuf
ungetc
__stdio_common_vsprintf
_set_fmode
fputc
_lseeki64
_open
fgets
__p__commode
ftell
fseek
_read
feof
fopen
fputs
__stdio_common_vsscanf
_write
_close
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
remove
_fstat64
_access
_unlock_file
_lock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
qsort
advapi32
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptDestroyHash
CryptHashData
Sections
.text Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ