File name: | CheatHub Launcher.exe |
Full analysis: | https://app.any.run/tasks/0f6febb8-46e3-4a92-b070-17d84739bdc6 |
Verdict: | Malicious activity |
Threats: | Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. |
Analysis date: | April 01, 2023, 14:42:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | 47AA5ACB9348139450621484FF697916 |
SHA1: | 78F7AB5CA82C8A2D0D145FC57191C1CF13655090 |
SHA256: | C79B3BD877F4E953032F1F44C303B1CA49AE6CEE3E7B0EB7BED619867B9CAE7E |
SSDEEP: | 24576:oU04MROxnFj38rkxrrcI0AilFEvxHP0Ioo+tmUh+P:omMi14qrrcI0AilFEvxHPcmUh+ |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
---|---|---|
.exe | | | Win64 Executable (generic) (23.8) |
.dll | | | Win32 Dynamic Link Library (generic) (5.6) |
.exe | | | Win32 Executable (generic) (3.8) |
.exe | | | Generic Win/DOS Executable (1.7) |
AssemblyVersion: | 1.0.0.0 |
---|---|
ProductVersion: | 5.0.0.0 |
ProductName: | - |
OriginalFileName: | Orcus.exe |
LegalTrademarks: | - |
LegalCopyright: | - |
InternalName: | CheatHub Launcher |
FileVersion: | 5.0.0.0 |
FileDescription: | https://discord.gg/B2rwQstA2U |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 5.0.0.0 |
FileVersionNumber: | 5.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0xe3bee |
UninitializedDataSize: | - |
InitializedDataSize: | 138752 |
CodeSize: | 924672 |
LinkerVersion: | 8 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2023:03:30 20:52:58+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 30-Mar-2023 20:52:58 |
Comments: | - |
CompanyName: | - |
FileDescription: | https://discord.gg/B2rwQstA2U |
FileVersion: | 5.0.0.0 |
InternalName: | CheatHub Launcher |
LegalCopyright: | - |
LegalTrademarks: | - |
OriginalFilename: | Orcus.exe |
ProductName: | - |
ProductVersion: | 5.0.0.0 |
Assembly Version: | 1.0.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 30-Mar-2023 20:52:58 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00002000 | 0x000E1BF4 | 0x000E1C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.15614 |
.rsrc | 0x000E4000 | 0x00021A0C | 0x00021C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.02716 |
.reloc | 0x00106000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.28751 | 831 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
2 | 3.06959 | 67624 | Latin 1 / Western European | UNKNOWN | RT_ICON |
3 | 3.49494 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
4 | 3.82346 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 4.15595 | 4264 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 4.84998 | 1128 | Latin 1 / Western European | UNKNOWN | RT_ICON |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2964 | "C:\Users\admin\AppData\Local\Temp\CheatHub Launcher.exe" | C:\Users\admin\AppData\Local\Temp\CheatHub Launcher.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: https://discord.gg/B2rwQstA2U Exit code: 3221226540 Version: 5.0.0.0 Modules
| |||||||||||||||
2992 | "C:\Users\admin\AppData\Local\Temp\CheatHub Launcher.exe" | C:\Users\admin\AppData\Local\Temp\CheatHub Launcher.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: https://discord.gg/B2rwQstA2U Exit code: 0 Version: 5.0.0.0 Modules
| |||||||||||||||
3740 | "C:\Windows\Microsoft.NET\Framework64\svchost.exe" | C:\Windows\Microsoft.NET\Framework64\svchost.exe | CheatHub Launcher.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: https://discord.gg/B2rwQstA2U Exit code: 0 Version: 5.0.0.0 Modules
Orcus(PID) Process(3740) svchost.exe Options WatchdogBuilderProperty PreventFileDeletiontrue WatchdogLocationAppData Namesvchost.exe IsEnabledtrue SetRunProgramAsAdminFlagBuilderProperty SetFlagtrue ServiceBuilderProperty Installfalse RespawnTaskBuilderProperty TaskNameWindowsSecurity IsEnabledtrue RequireAdministratorPrivilegesInstallerBuilderProperty RequireAdministratorPrivilegestrue ReconnectDelayProperty Delay10000 ProxyBuilderProperty ProxyType2 ProxyPort1080 ProxyAddressnull ProxyOptionNone MutexBuilderProperty Mutexce1afb0141ce4a1494682c5f82e6f580 KeyloggerBuilderProperty IsEnabledfalse InstallBuilderProperty Installtrue InstallationLocationBuilderProperty PathC:\Windows\Microsoft.NET\Framework64\svchost.exe HideFileBuilderProperty HideFiletrue FrameworkVersionBuilderProperty FrameworkVersionNET45 DisableInstallationPromptBuilderProperty IsDisabledtrue DefaultPrivilegesBuilderProperty RequireAdministratorRightstrue DataFolderBuilderProperty Path%appdata%\Orcus ClientTagBuilderProperty ClientTagnull ChangeIconBuilderProperty IconPathC:\Users\kuscg\Desktop\EVERYTHNG\grabber\v5.ico ChangeIcontrue ChangeCreationDateBuilderProperty NewCreationDate2023-03-30T22:49:42 IsEnabledfalse ChangeAssemblyInformationBuilderProperty AssemblyFileVersion5.0.0.0 AssemblyProductVersion5.0.0.0 AssemblyTrademarksnull AssemblyCopyrightnull AssemblyProductNamenull AssemblyCompanyNamenull AssemblyDescriptionhttps://discord.gg/B2rwQstA2U AssemblyTitleCheatHub Launcher ChangeAssemblyInformationtrue AutostartBuilderProperty TryAllAutostartMethodsOnFailtrue RegistryKeyNamesvchost RegistryHiddenStarttrue TaskHighestPrivilegestrue TaskSchedulerTaskNamesvchost AutostartMethodTaskScheduler Plugins (0) Keys Salt AES601d50b793155391553b8441c6dec63fe74582987d7bf899d18ff0d151d31f83 C2 (1)0.tcp.eu.ngrok.io:14481 | |||||||||||||||
908 | C:\Windows\Microsoft.NET\Framework64\svchost.exe | C:\Windows\Microsoft.NET\Framework64\svchost.exe | taskeng.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: https://discord.gg/B2rwQstA2U Exit code: 0 Version: 5.0.0.0 Modules
| |||||||||||||||
2876 | "C:\Users\admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\Windows\Microsoft.NET\Framework64\svchost.exe" 3740 /protectFile | C:\Users\admin\AppData\Roaming\svchost.exe | svchost.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 2904 Version: 1.0.0.0 Modules
| |||||||||||||||
2904 | "C:\Users\admin\AppData\Roaming\svchost.exe" /watchProcess "C:\Windows\Microsoft.NET\Framework64\svchost.exe" 3740 "/protectFile" | C:\Users\admin\AppData\Roaming\svchost.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
3436 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3944 | "C:\Program Files\Opera\opera.exe" -newtab "http://redir.opera.com/speeddials/myopera/" | C:\Program Files\Opera\opera.exe | explorer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
2792 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\{ff8675e4-d2e0-4246-aa9f-03fde0eab81e}.bat" " | C:\Windows\System32\cmd.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1872 | ping 127.0.0.1 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2992) CheatHub Launcher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2992) CheatHub Launcher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2992) CheatHub Launcher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2992) CheatHub Launcher.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3740) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3740) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3740) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3740) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2876) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2876) svchost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:665CF60B965CBC2541B9E44F3D806055 | SHA256:CFAAE074E76DF10852BEBF128D41DA8D6E05D239E4570267B673D722989D7ECE | |||
2992 | CheatHub Launcher.exe | C:\Windows\Microsoft.NET\Framework64\svchost.exe | executable | |
MD5:47AA5ACB9348139450621484FF697916 | SHA256:C79B3BD877F4E953032F1F44C303B1CA49AE6CEE3E7B0EB7BED619867B9CAE7E | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr4469.tmp | xml | |
MD5:C374FB61318CE112ECCD28DCC4D1DF5B | SHA256:7750EDEAE0554C49F14BECCC5B79C97C6AEDCC7976FFE044FCF4F92B5E72F0B1 | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr440B.tmp | text | |
MD5:665CF60B965CBC2541B9E44F3D806055 | SHA256:CFAAE074E76DF10852BEBF128D41DA8D6E05D239E4570267B673D722989D7ECE | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:C374FB61318CE112ECCD28DCC4D1DF5B | SHA256:7750EDEAE0554C49F14BECCC5B79C97C6AEDCC7976FFE044FCF4F92B5E72F0B1 | |||
3740 | svchost.exe | C:\Users\admin\AppData\Roaming\svchost.exe | executable | |
MD5:913967B216326E36A08010FB70F9DBA3 | SHA256:8D880758549220154D2FF4EE578F2B49527C5FB76A07D55237B61E30BCC09E3A | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr43FA.tmp | text | |
MD5:273F66BBFD419D2108F37D1F3DC9DB34 | SHA256:DB67C59C8D9F772B43EC0FD68680583B033DBAA449DAF673356A4CACDA55043C | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak | text | |
MD5:46A734B275C8C258D9D6F508E73B36AD | SHA256:B80192EDC377DD212C9E488E1983FBCD68CF83330576EFD7579B7AB30FA3672B | |||
3740 | svchost.exe | C:\Users\admin\AppData\Roaming\svchost.exe.config | xml | |
MD5:A2B76CEA3A59FA9AF5EA21FF68139C98 | SHA256:F99EF5BF79A7C43701877F0BB0B890591885BB0A3D605762647CC8FFBF10C839 | |||
3944 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win | text | |
MD5:273F66BBFD419D2108F37D1F3DC9DB34 | SHA256:DB67C59C8D9F772B43EC0FD68680583B033DBAA449DAF673356A4CACDA55043C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3740 | svchost.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c2a04ca45a09612b | US | compressed | 61.1 Kb | whitelisted |
3944 | opera.exe | GET | 400 | 185.26.182.94:80 | http://sitecheck2.opera.com/?host=my.opera.com&hdn=zQJpZ/kM7Js7KgRbFVagOQ== | unknown | html | 150 b | whitelisted |
3944 | opera.exe | GET | 302 | 185.26.182.110:80 | http://redir.opera.com/speeddials/myopera/ | unknown | html | 409 b | whitelisted |
3944 | opera.exe | GET | 400 | 185.26.182.94:80 | http://sitecheck2.opera.com/?host=redir.opera.com&hdn=H0WKpMbVXsif0I8OJoRVZA== | unknown | html | 150 b | whitelisted |
3944 | opera.exe | GET | 301 | 185.26.182.114:80 | http://my.opera.com/community/?utm_source=DesktopBrowser&utm_medium=SpeedDial&utm_campaign=BrowserLinks | unknown | html | 169 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3944 | opera.exe | 185.26.182.94:80 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
3944 | opera.exe | 185.26.182.93:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
3944 | opera.exe | 185.26.182.110:80 | redir.opera.com | Opera Software AS | — | unknown |
3944 | opera.exe | 54.93.100.158:443 | blogs.opera.com | AMAZON-02 | DE | unknown |
3944 | opera.exe | 185.26.182.114:80 | my.opera.com | Opera Software AS | — | suspicious |
3740 | svchost.exe | 3.124.142.205:14481 | 0.tcp.eu.ngrok.io | AMAZON-02 | DE | malicious |
3740 | svchost.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
0.tcp.eu.ngrok.io |
| malicious |
redir.opera.com |
| whitelisted |
sitecheck2.opera.com |
| whitelisted |
certs.opera.com |
| whitelisted |
my.opera.com |
| whitelisted |
blogs.opera.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
3944 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3944 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3944 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3944 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |