Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 05:38

General

  • Target

    Trojan-Ransom.Win32.GenericCryptor.exe

  • Size

    467KB

  • MD5

    4e573e2371d005c4b87d4f6d763531f2

  • SHA1

    2b07fb3ec245aa24b2799a9d225207fcd2a0d56f

  • SHA256

    308e2d9a98066c0789a73be20246262b10d29d5b0859421ede2274af17a57190

  • SHA512

    05e3f12a871bcfad6eead8ef8636c98914beef04ec48a3ffcd13b103dfe132efb9649cb32eddc9f931852cbba21d41a0148ca99be4a749c1f16cafd580c0f228

  • SSDEEP

    12288:olJ+TFukCI+P9CcrmwEuBwUqA5qFbAGTALHaspT:00U9CcrmwEPA5qFxT7CT

Score
10/10

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.GenericCryptor.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\hekey.exe
      "C:\Users\Admin\AppData\Local\Temp\hekey.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3608
      • C:\Users\Admin\AppData\Local\Temp\xemed.exe
        "C:\Users\Admin\AppData\Local\Temp\xemed.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3724
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
        PID:3732

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

            Filesize

            280B

            MD5

            c1a0648fe9d4b93ec746a6e41f3f7ca8

            SHA1

            57e04f2693480be87a11398ca938f8183e62db7c

            SHA256

            3de16b3be327336ff28d2383af13c7c6f0ae7d3b75884c4dc7a4885f54110e0c

            SHA512

            3c4320927f9468c11ef7e3641db0af457a344492873d49262b57d1fd4cc47d1c08f02a959a4e2cb93a6e2f447899501f4fb35da53726ded737f22c906fb4878d

          • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

            Filesize

            512B

            MD5

            cfa173f565973e1e53932ed6fbf85176

            SHA1

            02b4a70ca089a16df9959c75e355abc7f8d69a41

            SHA256

            cfdc4de5c83b66e16ca0dd636ab5c97e43e8dad1a7140a7bc30a28736978006c

            SHA512

            7c4349ff63e2bb245bd71e6af2b8208fb2660fc0187cc4c711e5825ae406892daca9199469ef72f4e395d16969b0a7cf0e56e2b230854b7fd797f98d11fd5548

          • C:\Users\Admin\AppData\Local\Temp\hekey.exe

            Filesize

            467KB

            MD5

            a5c46d21a52c4e0acab53dde87b3c41e

            SHA1

            84d373d216eac1919a5037e89bf17b1c2eca9784

            SHA256

            814e69cd594e8d09b6c470ef3bb2a5a202eff7445c4e459b484c2903d453bfb1

            SHA512

            60d952b735db40371b3c41adf6ff21da7735e348e29fe7b02b0094cf40cc0b3ff75837338f6bfbb009a39c70ecb0b82bd48dbd0b9045cedb1e012898e768b7aa

          • C:\Users\Admin\AppData\Local\Temp\xemed.exe

            Filesize

            242KB

            MD5

            2a7d1dd97b22db38d807bb3a62dfa799

            SHA1

            7406f6f4f5b70614d0ee9ef017b9cdd3e2e1c97a

            SHA256

            56620cf71d52d8f474e96c1a4618ff85a75074f76b389e427c807cd6fc585cca

            SHA512

            2b3320596b8e227e1a74bb72fe45cd52efc8b1910de0320e786fd2cddebf67386f136ce1490e5c30255a8208b5d3f363e8b77c734e56cd52626829aa4e2eccf0

          • memory/2668-1-0x00000000009A0000-0x00000000009A1000-memory.dmp

            Filesize

            4KB

          • memory/2668-0-0x0000000000140000-0x00000000001C2000-memory.dmp

            Filesize

            520KB

          • memory/2668-16-0x0000000000140000-0x00000000001C2000-memory.dmp

            Filesize

            520KB

          • memory/3608-38-0x0000000000200000-0x0000000000282000-memory.dmp

            Filesize

            520KB

          • memory/3608-19-0x0000000000200000-0x0000000000282000-memory.dmp

            Filesize

            520KB

          • memory/3608-14-0x0000000001040000-0x0000000001041000-memory.dmp

            Filesize

            4KB

          • memory/3608-10-0x0000000000200000-0x0000000000282000-memory.dmp

            Filesize

            520KB

          • memory/3724-37-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-40-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-39-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-41-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-43-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-44-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-45-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-46-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB

          • memory/3724-47-0x0000000000D70000-0x0000000000E1D000-memory.dmp

            Filesize

            692KB