Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/03/2026, 09:39
General
- Target 5BD40C30C012E80E0D130F53EE231042.exe
- Size 903KB
- Sample260304-lmssyaht21
- SHA256 7187957b04aa7d03fa88be6797e38d67a32565775e47090d18ef78cc4e004c89
Malware Config
Extracted
-
orcus
-
130.51.23.168:25565
-
877577f8a61a4bc3877796405d72bf29
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus family
- Orcus main payload 1 IoCs
- Orcurs Rat Executable 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5BD40C30C012E80E0D130F53EE231042.exe"C:\Users\Admin\AppData\Local\Temp\5BD40C30C012E80E0D130F53EE231042.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cre5jmb2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES415A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4159.tmp"3⤵
-
-
-
C:\Program Files\Orcus\Orcus.exe"C:\Program Files\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Orcus.exe
Orcus.exe.config
RES415A.tmp
cre5jmb2.dll
CSC4159.tmp
cre5jmb2.0.cs
cre5jmb2.cmdline
memory/1860-61-0x000000001CD00000-0x000000001CE0A000-memory.dmp
memory/1860-56-0x0000000003250000-0x0000000003260000-memory.dmp
memory/1860-59-0x000000001C4A0000-0x000000001C4B2000-memory.dmp
memory/1860-55-0x000000001BFC0000-0x000000001BFD8000-memory.dmp
memory/1860-54-0x0000000003240000-0x0000000003252000-memory.dmp
memory/1860-60-0x000000001CBB0000-0x000000001CBEC000-memory.dmp
memory/1860-52-0x0000000000EB0000-0x0000000000F98000-memory.dmp
memory/1860-62-0x000000001CFE0000-0x000000001D1A2000-memory.dmp
memory/1860-63-0x0000000001820000-0x000000000182C000-memory.dmp
memory/1860-64-0x000000001C5C0000-0x000000001C5D2000-memory.dmp
memory/1860-65-0x000000001C8F0000-0x000000001C99F000-memory.dmp
memory/2408-30-0x0000000000A20000-0x0000000000ACF000-memory.dmp
memory/2408-31-0x00000000009A0000-0x00000000009AC000-memory.dmp
memory/3128-12-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-14-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-34-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-33-0x000000001C210000-0x000000001C226000-memory.dmp
memory/3128-1-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-20-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-16-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-15-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-53-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-51-0x000000001CB80000-0x000000001CC2F000-memory.dmp
memory/3128-50-0x0000000000DA0000-0x0000000000DAC000-memory.dmp
memory/3128-35-0x0000000000DF0000-0x0000000000E02000-memory.dmp
memory/3128-13-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-0-0x00007FFF4B005000-0x00007FFF4B006000-memory.dmp
memory/3128-11-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-10-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-9-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-7-0x000000001C140000-0x000000001C1DC000-memory.dmp
memory/3128-8-0x00007FFF4AD50000-0x00007FFF4B6F1000-memory.dmp
memory/3128-6-0x000000001BBD0000-0x000000001C09E000-memory.dmp
memory/3128-5-0x000000001B6F0000-0x000000001B6FE000-memory.dmp
memory/3128-2-0x000000001B510000-0x000000001B56C000-memory.dmp
memory/3504-27-0x00000000001F0000-0x00000000001FC000-memory.dmp