Analysis
- max time kernel
149s - max time network
163s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/03/2026, 22:46
General
- Target 2026-03-16_4cc3e9b99b392013c15032fc69f7410c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 11.7MB
- Sample260316-2p2fvsgw4k
- SHA256 3b1fa8ba7815eb460f4a20bacfc6c19ccdd6401a463a136a4eff76ff914bda58
Malware Config
Extracted
-
orcus
-
103.27.156.29:5737
-
MUX18b7b92ea43c1b4a9ab0914be16cb
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Realtek\Audio\RtkAudUService32.exe
-
reconnect_delay
10000
-
registry_keyname
Realtek HD Audio Universal Service
-
taskscheduler_taskname
Microsoft\Windows\DeviceDirectoryClient\HandleAudio
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus family
- Orcus main payload 1 IoCs
- Custom signatureDetects executables containing common artifacts observed in infostealers 2 IoCs
- Custom signatureDetects executables manipulated with Fody 2 IoCs
- Enumerates VirtualBox DLL files 2 TTPs 10 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 3 IoCs
- Looks for VirtualBox executables on disk 2 TTPs 2 IoCs
- Orcurs Rat Executable 2 IoCs
- Looks for VMWare drivers on disk 2 TTPs 3 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 15 IoCs
- Drops file in Program Files directory 25 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-16_4cc3e9b99b392013c15032fc69f7410c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-16_4cc3e9b99b392013c15032fc69f7410c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-03-16_4cc3e9b99b392013c15032fc69f7410c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-16_4cc3e9b99b392013c15032fc69f7410c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmppmib08jp.exeC:\Users\Admin\AppData\Local\Temp\tmppmib08jp.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\load.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe" -pSAGP9eHKuXnhpfJw0LW2yHeR5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Realtek\Audio\RtkAudUService32.exe"C:\Program Files (x86)\Realtek\Audio\RtkAudUService32.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Program Files (x86)\Realtek\Audio\RtkAudUService32.exe"C:\Program Files (x86)\Realtek\Audio\RtkAudUService32.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RtkAudUService32.exe
load.vbs
loader.exe
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.cp39-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_uuid.pyd
base_library.zip
_rust.pyd
libcrypto-1_1.dll
libffi-7.dll
_psutil_windows.pyd
python3.DLL
python39.dll
select.pyd
unicodedata.pyd
tmppmib08jp.exe
memory/1296-128-0x00000000013D0000-0x00000000013EA000-memory.dmp
memory/1296-130-0x0000000005910000-0x00000000059D1000-memory.dmp
memory/1296-129-0x0000000001510000-0x0000000001622000-memory.dmp
memory/3296-73-0x000001E74AEE0000-0x000001E74AEEC000-memory.dmp
memory/5188-131-0x000001CD61AD0000-0x000001CD61ADC000-memory.dmp
memory/5404-107-0x00000000016B0000-0x00000000016BE000-memory.dmp
memory/5404-111-0x00000000057F0000-0x0000000005802000-memory.dmp
memory/5404-112-0x0000000005C70000-0x0000000005CBE000-memory.dmp
memory/5404-113-0x00000000063C0000-0x00000000063D8000-memory.dmp
memory/5404-115-0x0000000006590000-0x00000000065A8000-memory.dmp
memory/5404-116-0x0000000006900000-0x0000000006AC2000-memory.dmp
memory/5404-117-0x0000000006740000-0x0000000006750000-memory.dmp
memory/5404-118-0x0000000006840000-0x000000000684A000-memory.dmp
memory/5404-121-0x0000000007200000-0x0000000007266000-memory.dmp
memory/5404-122-0x0000000007A50000-0x0000000008068000-memory.dmp
memory/5404-123-0x0000000007270000-0x0000000007282000-memory.dmp
memory/5404-124-0x0000000007430000-0x000000000746C000-memory.dmp
memory/5404-125-0x0000000007470000-0x00000000074BC000-memory.dmp
memory/5404-126-0x00000000075F0000-0x00000000076FA000-memory.dmp
memory/5404-110-0x0000000005800000-0x0000000005892000-memory.dmp
memory/5404-109-0x0000000005D10000-0x00000000062B6000-memory.dmp
memory/5404-108-0x0000000005630000-0x000000000568C000-memory.dmp
memory/5404-106-0x0000000000990000-0x0000000000A78000-memory.dmp
memory/5404-132-0x0000000001320000-0x000000000133A000-memory.dmp
memory/5404-134-0x00000000058A0000-0x0000000005961000-memory.dmp
memory/5404-133-0x00000000016D0000-0x00000000017E2000-memory.dmp
memory/5404-136-0x00000000016D0000-0x00000000017E2000-memory.dmp
memory/5404-145-0x00000000016D0000-0x00000000017E2000-memory.dmp
memory/5404-172-0x00000000016D0000-0x00000000017E2000-memory.dmp