Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/08/2026, 13:49
General
- Target svchost.exe
- Size 908KB
- Sample260813-q4m18sam4t
- SHA256 48420e60d0d6aa1608c726cc7d689c4f218982c6b8cda31bcc2e449a81ecaefd
Malware Config
Extracted
-
orcus
-
standoff 2
-
178.215.236.150:27184
-
2619f17ddd83470e931cf06f35bed95c
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Nether\NetherCheat.exe
-
reconnect_delay
10000
-
registry_keyname
Nether
-
taskscheduler_taskname
NetherLoader
-
watchdog_path
Temp\NetherDog.exe
Signatures
- Family: Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Orcus main payload 1 IoCs
- Orcurs Rat Executable 1 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Nether\NetherCheat.exe"C:\Program Files (x86)\Nether\NetherCheat.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NetherDog.exe"C:\Users\Admin\AppData\Local\Temp\NetherDog.exe" /launchSelfAndExit "C:\Program Files (x86)\Nether\NetherCheat.exe" 440 /protectFile3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NetherDog.exe"C:\Users\Admin\AppData\Local\Temp\NetherDog.exe" /watchProcess "C:\Program Files (x86)\Nether\NetherCheat.exe" 440 "/protectFile"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Nether\NetherCheat.exe"C:\Program Files (x86)\Nether\NetherCheat.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NetherCheat.exe
NetherCheat.exe.config
NetherDog.exe.log
NetherDog.exe
memory/440-25-0x00000000062A0000-0x00000000062B0000-memory.dmp
memory/440-24-0x0000000005B90000-0x0000000005BA8000-memory.dmp
memory/440-46-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/440-26-0x00000000065E0000-0x00000000065EA000-memory.dmp
memory/440-22-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/440-23-0x0000000005B20000-0x0000000005B6E000-memory.dmp
memory/1192-40-0x00000000008C0000-0x00000000008C8000-memory.dmp
memory/1596-3-0x0000000005A10000-0x0000000005FB4000-memory.dmp
memory/1596-0-0x0000000000220000-0x000000000030A000-memory.dmp
memory/1596-5-0x0000000005530000-0x0000000005542000-memory.dmp
memory/1596-2-0x0000000005400000-0x000000000545C000-memory.dmp
memory/1596-4-0x0000000005550000-0x00000000055E2000-memory.dmp
memory/1596-1-0x00000000051B0000-0x00000000051BE000-memory.dmp
memory/1596-6-0x0000000005540000-0x0000000005548000-memory.dmp