Analysis
-
max time kernel
0s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11/01/2024, 16:53
General
-
Target
cad9fd9cbb6118db912f4465eb3fa786.exe
-
Size
444KB
-
MD5
cad9fd9cbb6118db912f4465eb3fa786
-
SHA1
aaa46a59b9a73766ba461c7f2d00cfbbdb563925
-
SHA256
c048f581df7a53413f2abb679a44d7f2e93a703c0c5c5cc3b037c1daac7ec74d
-
SHA512
50d7fa156afe16c03b59776d5b163dd0349abe9de9127195a75943cfd3b3cf58eb413bda0406f3e23610d9ae6133108a26690f6ada3ba0cf584d5051ea884d01
-
SSDEEP
6144:oEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpjdOx:oMpASIcWYx2U6hAJQnMU
Score
10/10
Malware Config
Extracted
Family
urelas
C2
218.54.31.165
218.54.31.226
Signatures
-
Urelas
Urelas is a trojan targeting card games.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad9fd9cbb6118db912f4465eb3fa786.exe"C:\Users\Admin\AppData\Local\Temp\cad9fd9cbb6118db912f4465eb3fa786.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\lexuc.exe"C:\Users\Admin\AppData\Local\Temp\lexuc.exe" hi2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\fenoeq.exe"C:\Users\Admin\AppData\Local\Temp\fenoeq.exe" OK1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\xokod.exe"C:\Users\Admin\AppData\Local\Temp\xokod.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB