Analysis
-
max time kernel
80s -
max time network
76s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
26/02/2025, 17:42
General
-
Target
Builder.exe
-
Size
1.0MB
-
MD5
6af52570404e4ba88d83c268bb9da934
-
SHA1
85765f1305efa0554c1624cdbcae3f91239a6a66
-
SHA256
da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
-
SHA512
5f3d2dbf8ee361ada96ee2c91f9b35397b3c5e692cb2bbf88b103b6c352c232622077e73847070c14418ed4c8689a6ae956ddedd6bd70b8cab702a795d5f6d2f
-
SSDEEP
24576:4DPS04YNEMuExDiU6E5R9s8xY/2l/dVB8Ibt+rYhmpnncVy:4Dl4auS+UjfU2T38Ibt+rbpnoy
Malware Config
Extracted
Family
orcus
C2
147.185.221.23
communications-sugar.gl.at.ply.gg
Mutex
d031b9dd54b940159425126d47f2c06a
Attributes
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
11/18/2024 13:11:11
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYQA0ADYAMQA1ADcAYgA2ADYAYgA1AGUANAA1AGEAZQBiADgAMQA1AGYAMgA0AGIAYgAzAGEAOQA3AGIANQA2AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDEANgA1ADMANAA1ADcANgBlAGQAZQA5ADQAYgAxADUAYgBiAGQAYQBmAGQAOQBkADEAZAA1ADYAOAAzAGUAZQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
aes.plain
Signatures
-
Orcus family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation Builder.exe -
Executes dropped EXE 1 IoCs
pid Process 4224 AudioDriver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Builder.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 4224 AudioDriver.exe 4224 AudioDriver.exe 4224 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4224 AudioDriver.exe Token: SeDebugPrivilege 2412 taskmgr.exe Token: SeSystemProfilePrivilege 2412 taskmgr.exe Token: SeCreateGlobalPrivilege 2412 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3468 wrote to memory of 4224 3468 Builder.exe 84 PID 3468 wrote to memory of 4224 3468 Builder.exe 84 PID 3468 wrote to memory of 4224 3468 Builder.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Builder.exe"C:\Users\Admin\AppData\Local\Temp\Builder.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD56af52570404e4ba88d83c268bb9da934
SHA185765f1305efa0554c1624cdbcae3f91239a6a66
SHA256da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
SHA5125f3d2dbf8ee361ada96ee2c91f9b35397b3c5e692cb2bbf88b103b6c352c232622077e73847070c14418ed4c8689a6ae956ddedd6bd70b8cab702a795d5f6d2f