Analysis
- max time kernel
146s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
02/06/2025, 22:44
General
- Target uploaded/123.exe
- Size 903KB
- Sample250602-2pacdabk21
- SHA256 94ad5e95fc0167221e93b241d4890649158fb8a59272d9e96ad741d3b7e51fff
Malware Config
Extracted
-
orcus
-
pont9245.ddns.net:7777
-
1d539aac48d74be6adc4ede7ba775530
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus family
- Orcurs Rat Executable 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\uploaded\123.exe"C:\Users\Admin\AppData\Local\Temp\uploaded\123.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1408-0-0x000000007485E000-0x000000007485F000-memory.dmp
memory/1408-1-0x00000000005A0000-0x0000000000688000-memory.dmp
memory/1408-2-0x0000000002B10000-0x0000000002B1E000-memory.dmp
memory/1408-3-0x0000000005020000-0x000000000507C000-memory.dmp
memory/1408-4-0x0000000074850000-0x0000000075000000-memory.dmp
memory/1408-5-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/1408-6-0x0000000005190000-0x0000000005222000-memory.dmp
memory/1408-7-0x0000000005170000-0x0000000005182000-memory.dmp
memory/1408-8-0x0000000005620000-0x000000000562A000-memory.dmp
memory/1408-10-0x0000000074850000-0x0000000075000000-memory.dmp