orcus | 163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
Size

920KB
MD5

bf28a4299deb6d5047d2defdac805ad8
SHA1

b4b31925fca63c42f66353ea863464d28a874071
SHA256

163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2
SHA512

92bec47a9b695acc2b54e2c78f5b591140c21cf4b3ad30108d5fb372ca51b6ff6b98f184cc73ee23aada2e8cf87b8b88921e34be060648c2714f1151340b1df0
SSDEEP

24576:Weu4MROxnFZ3WurRrZlI0AilFEvxHiBfWuM:WetMi7TrZlI0AilFEvxHiY

Score

10^/10

orcus discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

192.168.224.1:6969

Mutex

a4e1aea05229412fadaa047e2ae9b50c

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000194c4-38.dat	family_orcus

Orcurs Rat Executable 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000194c4-38.dat	orcus
behavioral1/memory/2608-42-0x00000000010F0000-0x00000000011DC000-memory.dmp	orcus

Executes dropped EXE 6 IoCs

pid	Process
2972	WindowsInput.exe
2616	WindowsInput.exe
2608	Orcus.exe
1648	Orcus.exe
2684	OrcusWatchdog.exe
744	OrcusWatchdog.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Orcus\Orcus.exe	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
File opened for modification	C:\Program Files\Orcus\Orcus.exe	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
File created	C:\Program Files\Orcus\Orcus.exe.config	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrcusWatchdog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2608	Orcus.exe
2608	Orcus.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
744	OrcusWatchdog.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe
2608	Orcus.exe
744	OrcusWatchdog.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	Orcus.exe
Token: SeDebugPrivilege	2684	OrcusWatchdog.exe
Token: SeDebugPrivilege	744	OrcusWatchdog.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2608	Orcus.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2608	Orcus.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2316	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	29
PID 908 wrote to memory of 2316	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	29
PID 908 wrote to memory of 2316	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	29
PID 2316 wrote to memory of 2156	2316	csc.exe	31
PID 2316 wrote to memory of 2156	2316	csc.exe	31
PID 2316 wrote to memory of 2156	2316	csc.exe	31
PID 908 wrote to memory of 2972	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	32
PID 908 wrote to memory of 2972	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	32
PID 908 wrote to memory of 2972	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	32
PID 908 wrote to memory of 2608	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	34
PID 908 wrote to memory of 2608	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	34
PID 908 wrote to memory of 2608	908	163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe	34
PID 2896 wrote to memory of 1648	2896	taskeng.exe	36
PID 2896 wrote to memory of 1648	2896	taskeng.exe	36
PID 2896 wrote to memory of 1648	2896	taskeng.exe	36
PID 2608 wrote to memory of 2684	2608	Orcus.exe	37
PID 2608 wrote to memory of 2684	2608	Orcus.exe	37
PID 2608 wrote to memory of 2684	2608	Orcus.exe	37
PID 2608 wrote to memory of 2684	2608	Orcus.exe	37
PID 2684 wrote to memory of 744	2684	OrcusWatchdog.exe	38
PID 2684 wrote to memory of 744	2684	OrcusWatchdog.exe	38
PID 2684 wrote to memory of 744	2684	OrcusWatchdog.exe	38
PID 2684 wrote to memory of 744	2684	OrcusWatchdog.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe
"C:\Users\Admin\AppData\Local\Temp\163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ftekpzhk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80E4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC80E3.tmp"
    3⤵
    PID:2156
- C:\Windows\SysWOW64\WindowsInput.exe
  "C:\Windows\SysWOW64\WindowsInput.exe" --install
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2972
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
    "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 2608 /protectFile
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe
      "C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 2608 "/protectFile"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:744

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\taskeng.exe
taskeng.exe {442CBB36-28FA-4722-BEE8-83EA93A89499} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files\Orcus\Orcus.exe
  "C:\Program Files\Orcus\Orcus.exe"
  2⤵
  - Executes dropped EXE
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Orcus\Orcus.exe

Filesize
920KB

MD5
bf28a4299deb6d5047d2defdac805ad8

SHA1
b4b31925fca63c42f66353ea863464d28a874071

SHA256
163f312e21ec1253901c9a2651311b6ca5205c41d858ca297c3d60c28dbeb5c2

SHA512
92bec47a9b695acc2b54e2c78f5b591140c21cf4b3ad30108d5fb372ca51b6ff6b98f184cc73ee23aada2e8cf87b8b88921e34be060648c2714f1151340b1df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES80E4.tmp

Filesize
1KB

MD5
04c14e823c402d7665151285031cd55f

SHA1
44f83d5f844ca530df03f9af2f20da55ae11e8a4

SHA256
5dd5fd68ea9bfcbe45ed405edb2a44e8c7657f61a461062d50fa240c356d1cd1

SHA512
d3887570d2c998ec2db6269fa5bfc269e1dae8f30b4e4fbbe95c3202877c0b60933636de2e93b3a13ce2616ecde4a1206131eaed6d114a4fe390e415a12915e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ftekpzhk.dll

Filesize
76KB

MD5
0d8ea773b8db2d24b158846ebac927e5

SHA1
2427862af71ccdcc5811b5ef3a1e7a8f89cebc0e

SHA256
5f718fc292f7820b7e0d6522288cffb78e8c75142c65773685acafcaf929597b

SHA512
be756b92b263c078eb82537c9f9dae6feb71475d18ea8219c3f6f671270533a1db861762d4c6f015abc739e77d1255911135a8e7acc26055687d258db25e326f

Download Submit
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe

Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe

Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC80E3.tmp

Filesize
676B

MD5
a3a274d747e68970102f00117c06c30c

SHA1
34752c9cc78c22ef8d7cfcb91f54eaf3e54aa9e4

SHA256
ffef61e07045287eeb2fcc8f0fd3f27db777ada528ce193eade87800f39e1de4

SHA512
d9490b4d81aebf171d69c24b19eedafb3394c4cb9dbd693e417878f423461258cf5477706450b972510b7de1a11cce2323bccba6d4f7f1a4d7d84e7eae69d9d4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ftekpzhk.0.cs

Filesize
208KB

MD5
6011503497b1b9250a05debf9690e52c

SHA1
897aea61e9bffc82d7031f1b3da12fb83efc6d82

SHA256
08f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434

SHA512
604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ftekpzhk.cmdline

Filesize
349B

MD5
c37306b67d33aa0d29f0cfe6bdd3d9f5

SHA1
acddca6bbdfe0ebe84bd20eb8fcdc517f5270f7b

SHA256
574e0e19557adfd721f0e114facba31a44dbb28be8e4dcd16acc962f2b754fa0

SHA512
3f27a54f71015cee95741623d497b35bb9b8642668d725f72cfb30414bf3b2c1e53a4e26ee798f3b8b3a534c5ed02145e10c7cdd588a654ebf4f22e3cff76c6a

Download Submit
memory/908-20-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/908-41-0x000007FEF5540000-0x000007FEF5EDD000-memory.dmp

Filesize
9.6MB

Download
memory/908-2-0x0000000000290000-0x000000000029E000-memory.dmp

Filesize
56KB

Download
memory/908-0-0x000007FEF57FE000-0x000007FEF57FF000-memory.dmp

Filesize
4KB

Download
memory/908-4-0x000007FEF5540000-0x000007FEF5EDD000-memory.dmp

Filesize
9.6MB

Download
memory/908-3-0x000007FEF5540000-0x000007FEF5EDD000-memory.dmp

Filesize
9.6MB

Download
memory/908-17-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/908-1-0x0000000000B10000-0x0000000000B6C000-memory.dmp

Filesize
368KB

Download
memory/2316-19-0x000007FEF5540000-0x000007FEF5EDD000-memory.dmp

Filesize
9.6MB

Download
memory/2316-58-0x000007FEF5540000-0x000007FEF5EDD000-memory.dmp

Filesize
9.6MB

Download
memory/2608-42-0x00000000010F0000-0x00000000011DC000-memory.dmp

Filesize
944KB

Download
memory/2608-43-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/2608-44-0x0000000000DC0000-0x0000000000E0E000-memory.dmp

Filesize
312KB

Download
memory/2608-45-0x0000000001040000-0x0000000001058000-memory.dmp

Filesize
96KB

Download
memory/2608-46-0x0000000001070000-0x0000000001080000-memory.dmp

Filesize
64KB

Download
memory/2616-32-0x00000000000D0000-0x00000000000DC000-memory.dmp

Filesize
48KB

Download
memory/2684-56-0x00000000008C0000-0x00000000008C8000-memory.dmp

Filesize
32KB

Download
memory/2972-28-0x0000000000C90000-0x0000000000C9C000-memory.dmp

Filesize
48KB

Download