Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 01:05
Behavioral task
behavioral1
Sample
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe
Resource
win10v2004-20240508-en
General
-
Target
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe
-
Size
1.1MB
-
MD5
b03ab8a74cf59fc472a4789bf8140c7f
-
SHA1
90ca9a977bd349a589c539511b5ccfe2387169c0
-
SHA256
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc
-
SHA512
d2d3e0b5e7a6f7358ace03d2ede2535ad5e5c7b68f8ce6a0112a0a2715850146f5d724f0f3824653724831bcb3c45587b6c79ad7765011cdefc85cdb0e55d321
-
SSDEEP
24576:91j4MROxnFE3FO3FrrcI0AilFEvxHPgWooLtW6pXcWSE+:9iMiuKFrrcI0AilFEvxHPg96VcWS
Malware Config
Extracted
orcus
In Silence
192.168.1.69:10134
a7fb4837861d40698b4e9e27bd20daa7
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
In Silence
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule \Program Files (x86)\Orcus\Orcus.exe family_orcus -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2984-1-0x0000000000CA0000-0x0000000000DBC000-memory.dmp orcus \Program Files (x86)\Orcus\Orcus.exe orcus behavioral1/memory/2552-35-0x0000000000880000-0x000000000099C000-memory.dmp orcus -
Executes dropped EXE 6 IoCs
Processes:
WindowsInput.exeWindowsInput.exeOrcus.exeOrcus.exeOrcusWatchdog.exeOrcusWatchdog.exepid process 2736 WindowsInput.exe 2756 WindowsInput.exe 2552 Orcus.exe 2624 Orcus.exe 2176 OrcusWatchdog.exe 2332 OrcusWatchdog.exe -
Loads dropped DLL 3 IoCs
Processes:
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exeOrcus.exepid process 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe 2552 Orcus.exe -
Drops file in System32 directory 3 IoCs
Processes:
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe.config 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe File created C:\Windows\SysWOW64\WindowsInput.exe 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exedescription ioc process File created C:\Program Files (x86)\Orcus\Orcus.exe 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe File opened for modification C:\Program Files (x86)\Orcus\Orcus.exe 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe File created C:\Program Files (x86)\Orcus\Orcus.exe.config 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Orcus.exeOrcusWatchdog.exepid process 2552 Orcus.exe 2552 Orcus.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2332 OrcusWatchdog.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe 2552 Orcus.exe 2332 OrcusWatchdog.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Orcus.exeOrcusWatchdog.exeOrcusWatchdog.exedescription pid process Token: SeDebugPrivilege 2552 Orcus.exe Token: SeDebugPrivilege 2176 OrcusWatchdog.exe Token: SeDebugPrivilege 2332 OrcusWatchdog.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Orcus.exepid process 2552 Orcus.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orcus.exepid process 2552 Orcus.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Orcus.exepid process 2552 Orcus.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exetaskeng.exeOrcus.exeOrcusWatchdog.exedescription pid process target process PID 2984 wrote to memory of 2736 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe WindowsInput.exe PID 2984 wrote to memory of 2736 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe WindowsInput.exe PID 2984 wrote to memory of 2736 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe WindowsInput.exe PID 2984 wrote to memory of 2736 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe WindowsInput.exe PID 2984 wrote to memory of 2552 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe Orcus.exe PID 2984 wrote to memory of 2552 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe Orcus.exe PID 2984 wrote to memory of 2552 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe Orcus.exe PID 2984 wrote to memory of 2552 2984 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe Orcus.exe PID 2828 wrote to memory of 2624 2828 taskeng.exe Orcus.exe PID 2828 wrote to memory of 2624 2828 taskeng.exe Orcus.exe PID 2828 wrote to memory of 2624 2828 taskeng.exe Orcus.exe PID 2828 wrote to memory of 2624 2828 taskeng.exe Orcus.exe PID 2552 wrote to memory of 2176 2552 Orcus.exe OrcusWatchdog.exe PID 2552 wrote to memory of 2176 2552 Orcus.exe OrcusWatchdog.exe PID 2552 wrote to memory of 2176 2552 Orcus.exe OrcusWatchdog.exe PID 2552 wrote to memory of 2176 2552 Orcus.exe OrcusWatchdog.exe PID 2176 wrote to memory of 2332 2176 OrcusWatchdog.exe OrcusWatchdog.exe PID 2176 wrote to memory of 2332 2176 OrcusWatchdog.exe OrcusWatchdog.exe PID 2176 wrote to memory of 2332 2176 OrcusWatchdog.exe OrcusWatchdog.exe PID 2176 wrote to memory of 2332 2176 OrcusWatchdog.exe OrcusWatchdog.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe"C:\Users\Admin\AppData\Local\Temp\1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe"C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /launchSelfAndExit "C:\Program Files (x86)\Orcus\Orcus.exe" 2552 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe"C:\Users\Admin\AppData\Roaming\OrcusWatchdog.exe" /watchProcess "C:\Program Files (x86)\Orcus\Orcus.exe" 2552 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {EEBC4FBA-9E15-41FF-B2E1-8A7FF9BD0DB4} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Orcus\Orcus.exe"C:\Program Files (x86)\Orcus\Orcus.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Orcus\err_a7fb4837861d40698b4e9e27bd20daa7.datFilesize
1KB
MD5e553da2ea6e9c6f3d5755a9dc57745da
SHA1bb08ea63145832461fadd69fefd482b30cad7834
SHA2562ac13c3af77aaaacb3385fe2d92789313c9f42e54e151657f9c9c91fef74808e
SHA5127af43962e548cbd13a909e24242fa8e1aa7e73480c5b8e6be81978fade96fe65803f038fa63bedd2e96e21c3dded5d013ab4921801a24cd872c8976b9a2f7020
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\Program Files (x86)\Orcus\Orcus.exeFilesize
1.1MB
MD5b03ab8a74cf59fc472a4789bf8140c7f
SHA190ca9a977bd349a589c539511b5ccfe2387169c0
SHA2561bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc
SHA512d2d3e0b5e7a6f7358ace03d2ede2535ad5e5c7b68f8ce6a0112a0a2715850146f5d724f0f3824653724831bcb3c45587b6c79ad7765011cdefc85cdb0e55d321
-
\Users\Admin\AppData\Roaming\OrcusWatchdog.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
memory/2176-52-0x00000000009D0000-0x00000000009D8000-memory.dmpFilesize
32KB
-
memory/2552-41-0x0000000004900000-0x0000000004910000-memory.dmpFilesize
64KB
-
memory/2552-40-0x0000000004220000-0x0000000004238000-memory.dmpFilesize
96KB
-
memory/2552-39-0x0000000004860000-0x00000000048AE000-memory.dmpFilesize
312KB
-
memory/2552-35-0x0000000000880000-0x000000000099C000-memory.dmpFilesize
1.1MB
-
memory/2736-19-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmpFilesize
9.9MB
-
memory/2736-16-0x000007FEF53D3000-0x000007FEF53D4000-memory.dmpFilesize
4KB
-
memory/2736-18-0x0000000001100000-0x000000000110C000-memory.dmpFilesize
48KB
-
memory/2736-22-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmpFilesize
9.9MB
-
memory/2756-24-0x0000000000190000-0x000000000019C000-memory.dmpFilesize
48KB
-
memory/2984-36-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2984-7-0x0000000000610000-0x0000000000618000-memory.dmpFilesize
32KB
-
memory/2984-0-0x000000007419E000-0x000000007419F000-memory.dmpFilesize
4KB
-
memory/2984-6-0x0000000000600000-0x0000000000608000-memory.dmpFilesize
32KB
-
memory/2984-5-0x0000000000560000-0x0000000000572000-memory.dmpFilesize
72KB
-
memory/2984-4-0x00000000021C0000-0x000000000221C000-memory.dmpFilesize
368KB
-
memory/2984-3-0x0000000074190000-0x000000007487E000-memory.dmpFilesize
6.9MB
-
memory/2984-2-0x00000000002F0000-0x00000000002FE000-memory.dmpFilesize
56KB
-
memory/2984-1-0x0000000000CA0000-0x0000000000DBC000-memory.dmpFilesize
1.1MB