Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2023, 18:29

General

  • Target

    NEAS.93977855e03dddef70cbf66b16c6be10.exe

  • Size

    465KB

  • MD5

    93977855e03dddef70cbf66b16c6be10

  • SHA1

    6c30aaf76da7bd5be3120a41977300a6068e8a9d

  • SHA256

    0b9a8a57f5f9b7a2bd41a12ddb854ee1b534c19f04ea83196682c2a85362ddaf

  • SHA512

    0d185f45b996e6a641970235b4cfeaaa0f96d795db7f5a61785b75eb2d7ace80f14b942ef479f98b99b44eb093bc1b8c0187502735cc854af244c933a04a2b39

  • SSDEEP

    6144:k9H4y9VOpL/DeRRoSGFPRuDYBzFrY5dRA2AkCMnZi6c/2AS9kFwJARejm7m:kZF9VOpnqoSG1EcBhs9xAkLZMomm

Score
10/10

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

218.54.30.235

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\sander.exe
      "C:\Users\Admin\AppData\Local\Temp\sander.exe"
      2⤵
      • Executes dropped EXE
      PID:2676
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
      2⤵
      • Deletes itself
      PID:1852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

    Filesize

    287B

    MD5

    076ff79aa57dc4c8c239c4e921e18bee

    SHA1

    44cd3009b8093b5e5889c23c6e49878958e9b83e

    SHA256

    5f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4

    SHA512

    956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c

  • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

    Filesize

    287B

    MD5

    076ff79aa57dc4c8c239c4e921e18bee

    SHA1

    44cd3009b8093b5e5889c23c6e49878958e9b83e

    SHA256

    5f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4

    SHA512

    956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    178eba193b631d7b0653896453b678b2

    SHA1

    8878cae8fb5417248da5800e4d85b00149160404

    SHA256

    8c7800dfaf639b17e6b682b6fa2365275e6f80d07e6aa6bb56b676669d0e9db5

    SHA512

    936f9ec171c7ad5aa63c6691d9ea109a3f1ef31fe00bc26fe5afa8ae0ee21b5d3f65e873a242e7986f98bcb9abc82911dbf34bb907ed7a4973e959b7e90c69d5

  • C:\Users\Admin\AppData\Local\Temp\sander.exe

    Filesize

    465KB

    MD5

    b3f612a14f3e19494f86c666e3957d04

    SHA1

    8c749a83b0dfd6cae653bf8ddcf8892807459291

    SHA256

    063053d70010fce1867f690bc160b9bde995cd0eab50eebc9992ad362b2a2c8a

    SHA512

    b98690c99a61c1c573a61f79d5ce9149467f94f098212a2c039d149d572d75681b7f7646d4e3d33308ea3c7b96099fc04823c6defe45bf579a9a59d8fe2f0df2

  • \Users\Admin\AppData\Local\Temp\sander.exe

    Filesize

    465KB

    MD5

    b3f612a14f3e19494f86c666e3957d04

    SHA1

    8c749a83b0dfd6cae653bf8ddcf8892807459291

    SHA256

    063053d70010fce1867f690bc160b9bde995cd0eab50eebc9992ad362b2a2c8a

    SHA512

    b98690c99a61c1c573a61f79d5ce9149467f94f098212a2c039d149d572d75681b7f7646d4e3d33308ea3c7b96099fc04823c6defe45bf579a9a59d8fe2f0df2

  • memory/2676-19-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2676-20-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/3060-0-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/3060-16-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB