Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 03:06
General
- Target jaffacakes118_Trojan-Spy.Win32.Zbot.zmck.exe
- Size 1.8MB
- Sample261016-dlynsswtfy
- SHA256 1b3509ff1e1950bb97d58447c4906ddeebf201ef194297279329a8ee8689db14
Malware Config
Extracted
-
orcus
-
185.208.211.22:21335
-
b7128d365a2148fd8a303179df4ff010
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
- Family: Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
- Drops desktop.ini file(s) 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.zmck.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.zmck.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4bd8pszb.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96C9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC96C8.tmp"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4bd8pszb.dll
RES96C9.tmp
4bd8pszb.0.cs
4bd8pszb.cmdline
CSC96C8.tmp
memory/956-31-0x0000000073800000-0x0000000073E21000-memory.dmp
memory/956-24-0x0000000073800000-0x0000000073E21000-memory.dmp
memory/1192-44-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/1192-6-0x0000000000400000-0x00000000004E8000-memory.dmp
memory/1192-33-0x0000000073800000-0x0000000073E21000-memory.dmp
memory/1192-45-0x0000000073802000-0x0000000073804000-memory.dmp
memory/1192-46-0x0000000073800000-0x0000000073E21000-memory.dmp
memory/1192-15-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/1192-16-0x0000000073802000-0x0000000073804000-memory.dmp
memory/3328-12-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-37-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-9-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-11-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-3-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3328-14-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-10-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-13-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-34-0x0000000005D70000-0x0000000005D71000-memory.dmp
memory/3328-35-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-36-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-5-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-42-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-41-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-40-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-39-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-38-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-43-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-8-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-7-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3328-4-0x0000000005D70000-0x0000000005D71000-memory.dmp