orcus | dd3ee854f6f62c1c964b74dc71fce2da6d29bdf1b8320f5173b1bce54e7c3413

Analysis

max time kernel
34s
max time network
34s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
03/04/2025, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kirasetup.exe
Size

3.3MB
MD5

35e41d1dc3e84b3eea60b9809199f3fa
SHA1

b8d2154bb56f0ad94effa5e8c57f4b51e345bf73
SHA256

dd3ee854f6f62c1c964b74dc71fce2da6d29bdf1b8320f5173b1bce54e7c3413
SHA512

a1cd7dc83a0304c46fdf0fe4855880f4d97a18fdef321674a4d00bade7afd8ea64530c55e1a9bd1e1ffce196ee7957f5227d42fdb9f33ecda8b8fae29d11c77a
SSDEEP

49152:gHBVPVP2ym8r2JdVTWRh1/6/R1I9AihZZ7WEqnXrtRI93iS5TChmqrjyBE3Hi8uy:iRAMBChm+jwE3HSOZssBs+H

Score

10^/10

orcus discovery rat spyware stealer

Malware Config

Extracted

Family

orcus

213.209.143.58:2095

Mutex

95c074471a264ae6acae057c3ed47a24

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\Nirsoft\sihost.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Realtek Audio Driver
watchdog_path
AppData\winsvrc.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus
Orcus family
orcus

Orcurs Rat Executable 1 IoCs

resource	yara_rule
behavioral1/memory/2864-1-0x0000000006FC0000-0x00000000070A8000-memory.dmp	orcus

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	kirasetup.exe

Executes dropped EXE 1 IoCs

pid	Process
5036	sihost.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Nirsoft\sihost.exe	kirasetup.exe
File created	C:\Program Files (x86)\Nirsoft\sihost.exe.config	kirasetup.exe
File opened for modification	C:\Program Files (x86)\Nirsoft\sihost.exe	kirasetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kirasetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 5036	2864	kirasetup.exe	89
PID 2864 wrote to memory of 5036	2864	kirasetup.exe	89
PID 2864 wrote to memory of 5036	2864	kirasetup.exe	89

C:\Users\Admin\AppData\Local\Temp\kirasetup.exe
"C:\Users\Admin\AppData\Local\Temp\kirasetup.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Nirsoft\sihost.exe
  "C:\Program Files (x86)\Nirsoft\sihost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Nirsoft\sihost.exe

Filesize
3.3MB

MD5
35e41d1dc3e84b3eea60b9809199f3fa

SHA1
b8d2154bb56f0ad94effa5e8c57f4b51e345bf73

SHA256
dd3ee854f6f62c1c964b74dc71fce2da6d29bdf1b8320f5173b1bce54e7c3413

SHA512
a1cd7dc83a0304c46fdf0fe4855880f4d97a18fdef321674a4d00bade7afd8ea64530c55e1a9bd1e1ffce196ee7957f5227d42fdb9f33ecda8b8fae29d11c77a

Download Submit
memory/2864-0-0x0000000004440000-0x0000000004525000-memory.dmp

Filesize
916KB

Download
memory/2864-1-0x0000000006FC0000-0x00000000070A8000-memory.dmp

Filesize
928KB

Download
memory/2864-2-0x00000000070B0000-0x00000000070BE000-memory.dmp

Filesize
56KB

Download
memory/2864-3-0x00000000070C0000-0x000000000711C000-memory.dmp

Filesize
368KB

Download
memory/2864-4-0x0000000007130000-0x00000000076D6000-memory.dmp

Filesize
5.6MB

Download
memory/2864-5-0x0000000007760000-0x00000000077F2000-memory.dmp

Filesize
584KB

Download
memory/2864-6-0x0000000007930000-0x0000000007942000-memory.dmp

Filesize
72KB

Download
memory/2864-9-0x0000000004440000-0x0000000004525000-memory.dmp

Filesize
916KB

Download