Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2023, 14:14

General

  • Target

    NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe

  • Size

    176KB

  • MD5

    8bd4ccc2173cf85bc191a7f084363960

  • SHA1

    900004717293acb7822fb304bc67fb3950139daf

  • SHA256

    8ba61061e2d0eafdb65f9b48746b225b97a08aa57c01999e9f7bafb320bcdc0c

  • SHA512

    d430eeffe104365c1598d8a8b728b187c0908908fcc12713c5c2417dfdb9883da95befedb5c987adef2412f69e00072e3b6433af70d31bca9da1289d00e88956

  • SSDEEP

    1536:Jv+x0V7eqzdYntSfGx+nAL2PdIkDNEnLAE0UtQgNMy3mvTtdK0vu5zypEh/tQX:IyVnYntSzWxnLj0OQg0tcau5zypEhFQX

Score
10/10

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

121.88.5.184

218.54.28.139

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\opert.exe
      "C:\Users\Admin\AppData\Local\Temp\opert.exe"
      2⤵
      • Executes dropped EXE
      PID:4496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
        PID:3912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      6735bbe93159782090eb9c49dde676c6

      SHA1

      6edec7009f27d90d36081a9d4a05fc6e6bde28e2

      SHA256

      f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217

      SHA512

      8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696

    • C:\Users\Admin\AppData\Local\Temp\opert.exe

      Filesize

      176KB

      MD5

      53c7fa2e64887d70fd8577da65a1258f

      SHA1

      ea9b87910b13f17605560f10cb5e3fadab6fed4f

      SHA256

      fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

      SHA512

      9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

    • C:\Users\Admin\AppData\Local\Temp\opert.exe

      Filesize

      176KB

      MD5

      53c7fa2e64887d70fd8577da65a1258f

      SHA1

      ea9b87910b13f17605560f10cb5e3fadab6fed4f

      SHA256

      fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

      SHA512

      9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

    • C:\Users\Admin\AppData\Local\Temp\opert.exe

      Filesize

      176KB

      MD5

      53c7fa2e64887d70fd8577da65a1258f

      SHA1

      ea9b87910b13f17605560f10cb5e3fadab6fed4f

      SHA256

      fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

      SHA512

      9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

    • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

      Filesize

      290B

      MD5

      b877009d95c362b63eda3d6688651ddf

      SHA1

      8b9ad34466a9143dffae105674072ef16f2b3ca0

      SHA256

      838b49b58bf63eb421198afbb512449da2c6ee1e6b51dc4dee557634dbb24f04

      SHA512

      ce3137c1e7fef3db631273be63486501a6e44b3560b379aa88b301ec5a024e7957103cd5d1632da3192252fc92506f8f44d7c4b14ae678d446dc4fb628e05d97

    • memory/1220-0-0x0000000000D30000-0x0000000000D5F000-memory.dmp

      Filesize

      188KB

    • memory/1220-14-0x0000000000D30000-0x0000000000D5F000-memory.dmp

      Filesize

      188KB

    • memory/4496-12-0x0000000000FA0000-0x0000000000FCF000-memory.dmp

      Filesize

      188KB

    • memory/4496-17-0x0000000000FA0000-0x0000000000FCF000-memory.dmp

      Filesize

      188KB