Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    173s
  • max time network
    201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2023, 16:10

General

  • Target

    NEAS.43356128735747b472d98211f980d57a.exe

  • Size

    124KB

  • MD5

    43356128735747b472d98211f980d57a

  • SHA1

    ead1956ef510f9ecd8d388b03a518af6de776a5f

  • SHA256

    831a3e29e0a1e5f06c60d956c5cac3d32dfb86d82c5ffa8cf1240e960c64855a

  • SHA512

    7905d04d93c6f57a8fd2f570bb4a8bad26627f98c6330d7e038f2309d00a90a795da9acb57a0db06281ec8273cf7e6eb9d4a8d0b67afc7f24e630132085dcb15

  • SSDEEP

    1536:3C+ltNKIxyDjxxNA6vOOZsBLD/qMJEAhHmRYHE7mqfm0yn:3C+ltUIs9pO9/jj8YKmF

Score
10/10

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.43356128735747b472d98211f980d57a.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.43356128735747b472d98211f980d57a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      PID:4284
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
        PID:3372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      6c7b9d5d0c8c895b27e9c92196ff145c

      SHA1

      5df3e0a05d84df13876a50c8607f6f86bf588380

      SHA256

      1246443d1394e56a60994bcc80a29239ffa86467f5fcfb4a962a50736b865dce

      SHA512

      64899b68c5812765762d076699fc007df0c4397a24999c3ad8cb3d7556737696b383b039c89b41099ee63249e7d76acbcf1fd84311de5abc98008b05fd176424

    • C:\Users\Admin\AppData\Local\Temp\huter.exe

      Filesize

      124KB

      MD5

      21725f6c5b54da2bc9872e6f4862b01b

      SHA1

      6ebe211b64a34d49f1625f37f8a396f86cae7753

      SHA256

      79a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163

      SHA512

      770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6

    • C:\Users\Admin\AppData\Local\Temp\huter.exe

      Filesize

      124KB

      MD5

      21725f6c5b54da2bc9872e6f4862b01b

      SHA1

      6ebe211b64a34d49f1625f37f8a396f86cae7753

      SHA256

      79a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163

      SHA512

      770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6

    • C:\Users\Admin\AppData\Local\Temp\huter.exe

      Filesize

      124KB

      MD5

      21725f6c5b54da2bc9872e6f4862b01b

      SHA1

      6ebe211b64a34d49f1625f37f8a396f86cae7753

      SHA256

      79a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163

      SHA512

      770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6

    • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

      Filesize

      284B

      MD5

      7255ac5fa85797ccdcec4bc0d5b0dec4

      SHA1

      666bc56ce3f59b114f1d3d6882c01d4ac834c70b

      SHA256

      b27c3c2db394427dd61cfaa0e22e906e62f03f37366a2c792c5e3d5b4b217c02

      SHA512

      ab45a9833c2b36d8479c62e6d72c3185020378db475bfc51852bddea9855b9381980d2be5cdec8ae524689efbeabc3e2ceb5ace792df4010bd7c08145d7baefd

    • memory/1492-0-0x0000000000440000-0x000000000048D000-memory.dmp

      Filesize

      308KB

    • memory/1492-4-0x0000000000440000-0x000000000048D000-memory.dmp

      Filesize

      308KB

    • memory/1492-16-0x0000000000440000-0x000000000048D000-memory.dmp

      Filesize

      308KB

    • memory/1492-1-0x0000000000440000-0x000000000048D000-memory.dmp

      Filesize

      308KB

    • memory/4284-13-0x00000000006F0000-0x000000000073D000-memory.dmp

      Filesize

      308KB

    • memory/4284-19-0x00000000006F0000-0x000000000073D000-memory.dmp

      Filesize

      308KB

    • memory/4284-21-0x00000000006F0000-0x000000000073D000-memory.dmp

      Filesize

      308KB

    • memory/4284-23-0x00000000006F0000-0x000000000073D000-memory.dmp

      Filesize

      308KB

    • memory/4284-30-0x00000000006F0000-0x000000000073D000-memory.dmp

      Filesize

      308KB