Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 18:29

General

  • Target

    NEAS.93977855e03dddef70cbf66b16c6be10.exe

  • Size

    465KB

  • MD5

    93977855e03dddef70cbf66b16c6be10

  • SHA1

    6c30aaf76da7bd5be3120a41977300a6068e8a9d

  • SHA256

    0b9a8a57f5f9b7a2bd41a12ddb854ee1b534c19f04ea83196682c2a85362ddaf

  • SHA512

    0d185f45b996e6a641970235b4cfeaaa0f96d795db7f5a61785b75eb2d7ace80f14b942ef479f98b99b44eb093bc1b8c0187502735cc854af244c933a04a2b39

  • SSDEEP

    6144:k9H4y9VOpL/DeRRoSGFPRuDYBzFrY5dRA2AkCMnZi6c/2AS9kFwJARejm7m:kZF9VOpnqoSG1EcBhs9xAkLZMomm

Score
10/10

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

218.54.30.235

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
      2⤵
        PID:2032
      • C:\Users\Admin\AppData\Local\Temp\sander.exe
        "C:\Users\Admin\AppData\Local\Temp\sander.exe"
        2⤵
        • Executes dropped EXE
        PID:4356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

      Filesize

      287B

      MD5

      076ff79aa57dc4c8c239c4e921e18bee

      SHA1

      44cd3009b8093b5e5889c23c6e49878958e9b83e

      SHA256

      5f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4

      SHA512

      956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      178eba193b631d7b0653896453b678b2

      SHA1

      8878cae8fb5417248da5800e4d85b00149160404

      SHA256

      8c7800dfaf639b17e6b682b6fa2365275e6f80d07e6aa6bb56b676669d0e9db5

      SHA512

      936f9ec171c7ad5aa63c6691d9ea109a3f1ef31fe00bc26fe5afa8ae0ee21b5d3f65e873a242e7986f98bcb9abc82911dbf34bb907ed7a4973e959b7e90c69d5

    • C:\Users\Admin\AppData\Local\Temp\sander.exe

      Filesize

      465KB

      MD5

      93fe63275b95aa77311747ba315736a9

      SHA1

      8cc3dee55de28b4487896cbb55920576d726345c

      SHA256

      0964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908

      SHA512

      a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d

    • C:\Users\Admin\AppData\Local\Temp\sander.exe

      Filesize

      465KB

      MD5

      93fe63275b95aa77311747ba315736a9

      SHA1

      8cc3dee55de28b4487896cbb55920576d726345c

      SHA256

      0964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908

      SHA512

      a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d

    • C:\Users\Admin\AppData\Local\Temp\sander.exe

      Filesize

      465KB

      MD5

      93fe63275b95aa77311747ba315736a9

      SHA1

      8cc3dee55de28b4487896cbb55920576d726345c

      SHA256

      0964750b7e6a4142ee28d9fddeec71403448a615116bafca5b519efcfba36908

      SHA512

      a6f7cbb9859b29e9a6e7bdd006d0ccf8ee39aaf21a5777c99181ff93afd6e2aaae38d05bc96d9668f98445bb3190b4c872f8df1328a27db57d48d0d71a319a0d

    • memory/3388-0-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/3388-14-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/4356-12-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/4356-17-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/4356-18-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB