orcus | 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Size 989KB
Sample261012-l2v7lsbe27
SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
MD5 55ae3963d3d9111647f466e72505f09a
SHA1 78ad34efe118e8f003f54cb840cbcb9a5870099f
SHA512 b31969f4f24f33dc0574dba633f751c5609659a815fd419312acecea08ca408d6cee40aed2bb73170814efe1d5ed8c2806b999c648857052157fa5a0e8954dbe
SSDEEP 24576:ODSAXt3rpQldN3YpAKg+ykQwL1cc9n2brRaa2NtFpevD7km:qbpON3YWB+ykQwZG0a2N3m7km
TLSH
T100252309E54A41E9C872C4720CBF4CFD1635E756E821DC7FC992DC61992228B7B23B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

diamond1 discovery orcus persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

diamond1

wh1t3h0rs3.duckdns.org:7007

Mutex

3fc98dbce316461fb6dd94bf608d1058

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Family: Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\secureapps.eVHXjjR36gXd1RYj.lnk	secureapps.exe

Executes dropped EXE 2 IoCs

pid	Process
836	secureapps.exe
3504	secureapps.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	secureapps.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	secureapps.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 3504	836	secureapps.exe	92

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	secureapps.exe
File created	C:\Windows\assembly\Desktop.ini	secureapps.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	secureapps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	secureapps.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	secureapps.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secureapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secureapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Token: SeDebugPrivilege	836	secureapps.exe
Token: SeDebugPrivilege	3504	secureapps.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	explorer.exe
3504	secureapps.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3092	2072	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe	89
PID 2088 wrote to memory of 836	2088	explorer.exe	91
PID 836 wrote to memory of 3504	836	secureapps.exe	92
PID 836 wrote to memory of 3504	836	secureapps.exe	92
PID 836 wrote to memory of 3504	836	secureapps.exe	92
PID 836 wrote to memory of 3504	836	secureapps.exe	92
PID 836 wrote to memory of 3504	836	secureapps.exe	92
PID 3504 wrote to memory of 4540	3504	secureapps.exe	93
PID 4540 wrote to memory of 2632	4540	csc.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3eeal1qm.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F85.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8F84.tmp"
        5⤵
        
        PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3eeal1qm.dll

Path C:\Users\Admin\AppData\Local\Temp\3eeal1qm.dll
Size 76KB
SHA256 17eb17a87d289b87421e6fb8a69b5cd2ff7641aae89f63b19b95b69f197a609c
MD5 a012e70a8764a5331d691386e6ae6ca5
SHA1 11a4b67038a06f3cf7d885d73ddbb7522ef97def
SHA512 74ddf9dde5439c8de9092dd0204af9cf0241b273cf85fc10ca48bb7410bec9543e2aaf1b0a5fbf9c6eb4037d966d2fbdbe71f7666604006da38f63defa0dea2e
SSDEEP 1536:H0G1SrjJnWB/bUgfa8UY21vfbKCHgC/6t:wmTU+Jd21vDKCHgC/6t
TLSH
T11B73304073D62F2AD3BE43F054B12A168FF2B816F85BE2D9ADC460E926E57404DC1F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8F85.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8F85.tmp
Size 1KB
SHA256 5b9b0c0f36786de753e7f1dc327a0cdfe695bc10d0f41268f4812a47b8441154
MD5 6d7e7810a0e11832ddf8a1618dd88756
SHA1 cb7a1f873e27b46ca9d8a58d38b2537807f17fc1
SHA512 beafa3bf4847650758351ced498aee2b760a48b7747a81537a7f5436e70c9e9c9ebfd5624f12372fe41ce42f17de364842c4a6423374d3b90698404bc00a6bb2
TLSH
T101217A1867E9471AF1B38B32A8F613269278FEA0DEB2736E449405292C50500EFA1B77
MD5 SHA1 SHA512 TLSH

Submit Download

secureapps.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
Size 989KB
SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
MD5 55ae3963d3d9111647f466e72505f09a
SHA1 78ad34efe118e8f003f54cb840cbcb9a5870099f
SHA512 b31969f4f24f33dc0574dba633f751c5609659a815fd419312acecea08ca408d6cee40aed2bb73170814efe1d5ed8c2806b999c648857052157fa5a0e8954dbe
SSDEEP 24576:ODSAXt3rpQldN3YpAKg+ykQwL1cc9n2brRaa2NtFpevD7km:qbpON3YWB+ykQwZG0a2N3m7km
TLSH
T100252309E54A41E9C872C4720CBF4CFD1635E756E821DC7FC992DC61992228B7B23B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3eeal1qm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3eeal1qm.0.cs
Size 208KB
SHA256 8b6070299de5cb92cf8b8df100d81128d2ee6ffab67710c49a1d75483ab04a85
MD5 f0fb117030a600507c5d9be2d3793bee
SHA1 18df129d7e2ae0f1bc1ee590d4d2919dd7671edf
SHA512 4e2f454b412c8e0d699edfb8e898d1111b127f2be81da222e90afa982a6526fbd5ea0703f4508c93265c2f9e6ded64d90bba4e320d11a43166e7f6b8400ddc98
SSDEEP 6144:1HD7atIQwsFGAhrtARJmHD7atIQwt2/I32ume5fTJ9DvQG5PaP6TufsWY5/m:petIUFGAhrtARJCetIV2/I32ume5fTJi
TLSH
T1852462787100AB1201B763FAE791C887F9768527052EA530BACCC49AEFB85128775F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3eeal1qm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3eeal1qm.cmdline
Size 347B
SHA256 5f553d00a2d63804e25c80704229e07d42ff5c9e263fc222f7f45f1f48e68a12
MD5 41ff30734089665ebeb0e4b15fd46d86
SHA1 6e23424ab36a7078e4484b3c7507f53ec9bf67cc
SHA512 daa204e3ce2c79e90b5f2ecf9c266c0311528ed4a8105ae52608d2067c0d60766cf37f3d52fcfb8db1db8af1d088513cb7934affaea56ed4bd2302fd4d9c9d86
TLSH
T14BE0C02D075BC13615F1721225C86B4C52D2C60F3D417F388610448D201342976817C4
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8F84.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8F84.tmp
Size 676B
SHA256 98761d4eb1f3cacb32de4329ae396dbcbd0b729b7bd4751b30fcb4c8ef6b81ce
MD5 8c669ed781123df74734b43e96487786
SHA1 5a5d2da5147e7c170ba6b62fd3ef2cc61ccb17ed
SHA512 502a9e6e338ca03536e9af5b41fb27f4753529997a8aa64aa280299ca58975e65c0f679e8339207d9a7923ee7c86228eeba35bf247168be6532aa45281c7d9e5
TLSH
T17301F05867F80229F0F38B30BCF5439391A8BC50DE3363AC1494060A2C609109AA6BBB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2072-0-0x0000000001340000-0x0000000001350000-memory.dmp

Download

memory/2072-1-0x0000000074C02000-0x0000000074C04000-memory.dmp

Download

memory/2072-2-0x0000000074C00000-0x0000000075221000-memory.dmp

Download

memory/2072-3-0x0000000074C00000-0x0000000075221000-memory.dmp

Download

memory/3504-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads