Analysis

  • max time kernel
    171s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 20:02

General

  • Target

    NEAS.2128d65eea52936c695b39b8b54303d0.exe

  • Size

    484KB

  • MD5

    2128d65eea52936c695b39b8b54303d0

  • SHA1

    f2afc7542687cd63fef814f699ca1dfe356c9389

  • SHA256

    aae96674a0b19705dc25eef5837517d6e4eb43d0785b5d6d234d0fb001f1a587

  • SHA512

    5071ec98ad8a24c78829e67c3eedeb38ccfcc317d2141443af616525050391622e437ea0ba683d1a34ffa33a263d1a01f19119d77e762ad21b3bbce46b6380cf

  • SSDEEP

    6144:KxBWeMRygxDLbHxlSBxzJb1REBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGDq+t5:63MQIDKJPTq+Xxvo0U+d3s/fCX0a5

Score
10/10

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

218.54.30.235

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2128d65eea52936c695b39b8b54303d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2128d65eea52936c695b39b8b54303d0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\fodya.exe
      "C:\Users\Admin\AppData\Local\Temp\fodya.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Users\Admin\AppData\Local\Temp\dimif.exe
        "C:\Users\Admin\AppData\Local\Temp\dimif.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4288
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
      2⤵
        PID:3336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

      Filesize

      287B

      MD5

      085190a83c796ec4ae750fa40f950570

      SHA1

      9fd834adf35941bcd0b754c7135c95076609cc05

      SHA256

      26be5329163392f1b37089d7cfcbefc6001ce40458991ee5afc448229b439099

      SHA512

      83df415427403b0a075c18fb9ec70c6970663e49c7f44df9b58639cf6536e1e95e1b78677431e1f0fd3208aac5634e5c6bf1fe77d6ab604bbca242f23d47edb7

    • C:\Users\Admin\AppData\Local\Temp\dimif.exe

      Filesize

      243KB

      MD5

      2870e11672dfffc15678963c5612d381

      SHA1

      b8b57b2421b3c659b46243ef91aceb7f604582b1

      SHA256

      7a8ef413d865dffc5919af7ec3bd2fc7fd85a2c46b32480763158a62e46abfdf

      SHA512

      bfb7072d00b85a7d3984e592b8ce46f13427e1eeb3c404a09c061b52e5293843220d112adaffb0d3ca7c37e3b4f33fb695def801564604b383c71a397f4df2c5

    • C:\Users\Admin\AppData\Local\Temp\dimif.exe

      Filesize

      243KB

      MD5

      2870e11672dfffc15678963c5612d381

      SHA1

      b8b57b2421b3c659b46243ef91aceb7f604582b1

      SHA256

      7a8ef413d865dffc5919af7ec3bd2fc7fd85a2c46b32480763158a62e46abfdf

      SHA512

      bfb7072d00b85a7d3984e592b8ce46f13427e1eeb3c404a09c061b52e5293843220d112adaffb0d3ca7c37e3b4f33fb695def801564604b383c71a397f4df2c5

    • C:\Users\Admin\AppData\Local\Temp\dimif.exe

      Filesize

      243KB

      MD5

      2870e11672dfffc15678963c5612d381

      SHA1

      b8b57b2421b3c659b46243ef91aceb7f604582b1

      SHA256

      7a8ef413d865dffc5919af7ec3bd2fc7fd85a2c46b32480763158a62e46abfdf

      SHA512

      bfb7072d00b85a7d3984e592b8ce46f13427e1eeb3c404a09c061b52e5293843220d112adaffb0d3ca7c37e3b4f33fb695def801564604b383c71a397f4df2c5

    • C:\Users\Admin\AppData\Local\Temp\fodya.exe

      Filesize

      484KB

      MD5

      c5797968662811240990797a3131dc2c

      SHA1

      a5edc55b0f9a0bcb4f18d26f0ca05432854f914a

      SHA256

      0fcd0c81bcfd989b5c361df519a3ce06b43723dc3d18aeea2b32470b28abdbf8

      SHA512

      eab77ade6c151e113849cbc92de267bc70caab2c8aa11fc286118bb5b809e135385f149b1438c948c4858d0c0510746261b483f9ea9ba474f481930180ed6448

    • C:\Users\Admin\AppData\Local\Temp\fodya.exe

      Filesize

      484KB

      MD5

      c5797968662811240990797a3131dc2c

      SHA1

      a5edc55b0f9a0bcb4f18d26f0ca05432854f914a

      SHA256

      0fcd0c81bcfd989b5c361df519a3ce06b43723dc3d18aeea2b32470b28abdbf8

      SHA512

      eab77ade6c151e113849cbc92de267bc70caab2c8aa11fc286118bb5b809e135385f149b1438c948c4858d0c0510746261b483f9ea9ba474f481930180ed6448

    • C:\Users\Admin\AppData\Local\Temp\fodya.exe

      Filesize

      484KB

      MD5

      c5797968662811240990797a3131dc2c

      SHA1

      a5edc55b0f9a0bcb4f18d26f0ca05432854f914a

      SHA256

      0fcd0c81bcfd989b5c361df519a3ce06b43723dc3d18aeea2b32470b28abdbf8

      SHA512

      eab77ade6c151e113849cbc92de267bc70caab2c8aa11fc286118bb5b809e135385f149b1438c948c4858d0c0510746261b483f9ea9ba474f481930180ed6448

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      8e4769c2882861526a44495df269406a

      SHA1

      3ddf431b64900d1adee37aa1d1d58f7bd896a5e2

      SHA256

      b92a2ebf9df525fd05d892d5a2850f6a7ef007072697c3be9a423a343aaf6489

      SHA512

      9c474150246129ae083f183d13d4df92f0c600a4a9ae2650eea17a065cbb403155be86185c17c72e8dfe651baf17a2d5c14d0376e532042d0a3d0ad83e00ad56

    • memory/552-12-0x0000000000DA0000-0x0000000000E47000-memory.dmp

      Filesize

      668KB

    • memory/552-17-0x0000000000DA0000-0x0000000000E47000-memory.dmp

      Filesize

      668KB

    • memory/552-27-0x0000000000DA0000-0x0000000000E47000-memory.dmp

      Filesize

      668KB

    • memory/2988-14-0x0000000000940000-0x00000000009E7000-memory.dmp

      Filesize

      668KB

    • memory/2988-0-0x0000000000940000-0x00000000009E7000-memory.dmp

      Filesize

      668KB

    • memory/4288-26-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-28-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-29-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-30-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-31-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-32-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-33-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB

    • memory/4288-34-0x0000000000A10000-0x0000000000ACA000-memory.dmp

      Filesize

      744KB