Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 02:21

General

  • Target

    ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb.exe

  • Size

    417KB

  • MD5

    5323d5a77f6ce194a9023df2dccd6d19

  • SHA1

    0a611ca0a52faedeca469c32d4e6d07365dcf373

  • SHA256

    ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb

  • SHA512

    523bfafe538e7bd8499cfed1a97963878e726e582b75180124cb18fb8678504fa1417ab746621ca83971c3f8860212ba294021a08bc2bb40de6ee4832dc23544

  • SSDEEP

    6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYqD:eU7M5ijWh0XOW4sEfeObD

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb.exe
    "C:\Users\Admin\AppData\Local\Temp\ed4a3ac063fdf8824e5380a61344367a6966a3acf5d9f903cd1cf0ddb332a2fb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Local\Temp\ibhop.exe
      "C:\Users\Admin\AppData\Local\Temp\ibhop.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\cypuh.exe
        "C:\Users\Admin\AppData\Local\Temp\cypuh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4232
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
        PID:1556

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

            Filesize

            340B

            MD5

            f0d4c528db1a5a3deab717cc3f4844a9

            SHA1

            3b46c4d928e3dce0afff3ea5ed8425af472b4995

            SHA256

            7a51e5f482fbe5350a629f76b31bdf3114f38fdce4f049920467feec74a12389

            SHA512

            68e238d9b7166e321cb722416b82121d9c0d3e3dbc8619b01f6a5b8edba52a058d33fe4cf649be4e22766259f7543806fd17049dc4753b7c08b2a2e07ef89b05

          • C:\Users\Admin\AppData\Local\Temp\cypuh.exe

            Filesize

            212KB

            MD5

            4fa79894f90b494e3ad3b79ef9970b08

            SHA1

            ab37328cd01c5c6f725ea392ca4f3d6903359e6c

            SHA256

            3ab8c0b7acbc610ce09077ce4a571d33aca5416c6133f43b5640ffad3020d6e9

            SHA512

            b6e94e90e364cf9a4c53379990b0da2b173ed7af7c515784d2e934191ef6f94120721b7dc161a2a7a9943c90a59f394cdd251d287ff88e307e03a934a639d57e

          • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

            Filesize

            512B

            MD5

            4a5a906094a1838e0448c5be6d4c376b

            SHA1

            228d9464f2bc418b66fc397cda340fe6316375f6

            SHA256

            cf5298f94621fd6c03864fd022eacfd50bf6e79ad3a4a152cc82b0d20e8c0ff9

            SHA512

            497e0d838f474764efdf2f94a15f46d586d3d1274595f20f5dba944502cedb2bf739ff16953c2c674e39ce07d3431cdce1706f099f2379d69385fd713fc08bb5

          • C:\Users\Admin\AppData\Local\Temp\ibhop.exe

            Filesize

            417KB

            MD5

            f4535a61af99f166e08f80cd9323aecd

            SHA1

            bec15e9d468f804c6085b2d69fe9c9fbf7c0f8a1

            SHA256

            244c4020b858272d8e141240306923518afe85aaa672342b14b5c32148635a3a

            SHA512

            c0d8f2d935e1542ac7fa9aad76cf1587022dd23aadebee82c746c5f0b5e0dc1946957e56bb97fddeb9e9dcb8260e79fc615fbcc813f06778b5bb0fd6760becc6

          • memory/1688-12-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/1688-26-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/4016-0-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/4016-14-0x0000000000400000-0x0000000000465000-memory.dmp

            Filesize

            404KB

          • memory/4232-28-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-29-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-27-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-31-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-32-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-33-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-34-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB

          • memory/4232-35-0x00000000003A0000-0x0000000000434000-memory.dmp

            Filesize

            592KB