Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 18:49

General

  • Target

    NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe

  • Size

    392KB

  • MD5

    a9ee5717f9ed4aa52358a2dce5cd24e6

  • SHA1

    fb07be112019076233e0012986e97738c06b9ea4

  • SHA256

    984d9cf4b34ed3602c3773af5aa6634f0fde8f5014412ff69064f40b53ca86e4

  • SHA512

    ace8009bb0a17385a51ec52e83f72edb1551a29a7c76c9c921d1e05ad75315318d66becf96111d4cc6ac12e78caa9090a05b3a416fcbd5ea3badeb9565ba75ab

  • SSDEEP

    12288:fEOZQtZVa6JdD/lHoOMzXCGOoIVdDHMxj:fE1HVa2dDNIrrCGOoQDAj

Score
10/10

Malware Config

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Local\Temp\zyxuu.exe
      "C:\Users\Admin\AppData\Local\Temp\zyxuu.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Users\Admin\AppData\Local\Temp\roomp.exe
        "C:\Users\Admin\AppData\Local\Temp\roomp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
      2⤵
        PID:4272

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

      Filesize

      307B

      MD5

      70f5f3d86a52653f179a833e5cc41241

      SHA1

      ba76332fc40e2ba4e0d3baba6be290249d4fdd64

      SHA256

      fcebea282d9e05680c0864aafaa294bd31bfd3fe6e1bee3462169cdc922dcd40

      SHA512

      065ec402443442d969e6d67e19e60d8a0b9a1529cc926c8b54a1754b6098d785c4645e75dbb0578218c4bc5346bf1b126bb96419e962bad1b3c03fdae8273eab

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      593b447cb1ec56e80388316e6e867afa

      SHA1

      daf05a0950336d3fdef0c9902e5014811f5f3605

      SHA256

      5bbd34cfbaf7ae4c90a2a8fede8564f174b499b6e327a5004d9ab02989d00bcf

      SHA512

      8384f3e8c43accb3cbb93cb0f4159c4bf924f28d388b368bdb66f939f6ee4795ccdbeccb85ac3d16e3a0ae74966171291ad54f3f2713dc08ebb56d75dc9a1a57

    • C:\Users\Admin\AppData\Local\Temp\roomp.exe

      Filesize

      182KB

      MD5

      ba176833bf5e935a32048cbdc526aded

      SHA1

      6066cdc6cda1e4f92d28bca734193801d4946bd5

      SHA256

      608cf156567894191df302c6579a5db6085f969c16dea5eb5c3c894a96f2a983

      SHA512

      7be97362ce4ce942583307fbae4554066aea8e4211e3de7ee85ddb86f822a6c4ce79dc1ab631f54e67893ac6f87fdf792bef01c86069414652c70c72fbf93277

    • C:\Users\Admin\AppData\Local\Temp\roomp.exe

      Filesize

      182KB

      MD5

      ba176833bf5e935a32048cbdc526aded

      SHA1

      6066cdc6cda1e4f92d28bca734193801d4946bd5

      SHA256

      608cf156567894191df302c6579a5db6085f969c16dea5eb5c3c894a96f2a983

      SHA512

      7be97362ce4ce942583307fbae4554066aea8e4211e3de7ee85ddb86f822a6c4ce79dc1ab631f54e67893ac6f87fdf792bef01c86069414652c70c72fbf93277

    • C:\Users\Admin\AppData\Local\Temp\roomp.exe

      Filesize

      182KB

      MD5

      ba176833bf5e935a32048cbdc526aded

      SHA1

      6066cdc6cda1e4f92d28bca734193801d4946bd5

      SHA256

      608cf156567894191df302c6579a5db6085f969c16dea5eb5c3c894a96f2a983

      SHA512

      7be97362ce4ce942583307fbae4554066aea8e4211e3de7ee85ddb86f822a6c4ce79dc1ab631f54e67893ac6f87fdf792bef01c86069414652c70c72fbf93277

    • C:\Users\Admin\AppData\Local\Temp\zyxuu.exe

      Filesize

      392KB

      MD5

      09aadd779b15aa9d7a1e78e796c2e574

      SHA1

      5de7018b2dea881ab5b7f0f5b3ff69096d93daf8

      SHA256

      ed442deed1ed8613d4bec0c6b65b75e83a72b33e5d928f08bcba4d5d6401ac7e

      SHA512

      c7a81fff285f60e5e922a890328a36945e816a50b53b2c0d68861be18a5a4d8ad8ce69ce9957ed8006a135d301dbff0d17129bcaf49b1f26737736833cc0464d

    • C:\Users\Admin\AppData\Local\Temp\zyxuu.exe

      Filesize

      392KB

      MD5

      09aadd779b15aa9d7a1e78e796c2e574

      SHA1

      5de7018b2dea881ab5b7f0f5b3ff69096d93daf8

      SHA256

      ed442deed1ed8613d4bec0c6b65b75e83a72b33e5d928f08bcba4d5d6401ac7e

      SHA512

      c7a81fff285f60e5e922a890328a36945e816a50b53b2c0d68861be18a5a4d8ad8ce69ce9957ed8006a135d301dbff0d17129bcaf49b1f26737736833cc0464d

    • C:\Users\Admin\AppData\Local\Temp\zyxuu.exe

      Filesize

      392KB

      MD5

      09aadd779b15aa9d7a1e78e796c2e574

      SHA1

      5de7018b2dea881ab5b7f0f5b3ff69096d93daf8

      SHA256

      ed442deed1ed8613d4bec0c6b65b75e83a72b33e5d928f08bcba4d5d6401ac7e

      SHA512

      c7a81fff285f60e5e922a890328a36945e816a50b53b2c0d68861be18a5a4d8ad8ce69ce9957ed8006a135d301dbff0d17129bcaf49b1f26737736833cc0464d

    • memory/1172-0-0x0000000000220000-0x0000000000285000-memory.dmp

      Filesize

      404KB

    • memory/1172-14-0x0000000000220000-0x0000000000285000-memory.dmp

      Filesize

      404KB

    • memory/2124-26-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

      Filesize

      8KB

    • memory/2124-36-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-39-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-27-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-38-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-31-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-32-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

      Filesize

      8KB

    • memory/2124-33-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-34-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-35-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-25-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/2124-37-0x0000000000A70000-0x0000000000B07000-memory.dmp

      Filesize

      604KB

    • memory/4160-28-0x0000000000330000-0x0000000000395000-memory.dmp

      Filesize

      404KB

    • memory/4160-9-0x0000000000330000-0x0000000000395000-memory.dmp

      Filesize

      404KB