Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2024, 21:27

General

  • Target

    7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe

  • Size

    125KB

  • MD5

    6722222e3dc78a102eafdf8d2f9fb340

  • SHA1

    e14fe7b40686cb36c0b54e65a477b81a56410420

  • SHA256

    7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d

  • SHA512

    45501b8f23e300f5ada301f7968c1bd234f4f056503beed4978d3ff17beee42e930bf50de9b5518e3f4e72fed1d586ad59c28532a3994d905924926613f84f67

  • SSDEEP

    1536:Ko6JdvxttIBcXISDPV2Mhg3GkFceersWjcd06UsfqW2vxq6UU/HpX:iHC6D92O8n7eU06UsfUpqCx

Score
10/10

Malware Config

Extracted

Family

urelas

C2

112.175.88.209

112.175.88.207

112.175.88.208

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe
    "C:\Users\Admin\AppData\Local\Temp\7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2624
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      PID:2532

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

          Filesize

          125KB

          MD5

          fdbefa0c1e752d50214d4c836107e114

          SHA1

          432deef8edfca72a89d2c77cc2fcbb649db6ebb8

          SHA256

          61d2a491d28d4cff00de84e52578ffd45047d18e5cd0b3da1f1b7a3f70d4be47

          SHA512

          9956007e15aa408f2971274cbc21c70e88091cc1176bfa35adc06b9cd0fcf193dfdda659b1729913056a6e0230440a79f44a20230036869430c7210e09b7e677

        • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

          Filesize

          512B

          MD5

          d8b6fb23d659bed3f6b1cf40a104e95a

          SHA1

          07c9c74af6b0fe9b78bb1b3aed5bdc1e0b5de952

          SHA256

          f28d96334bf66f634f899c800b4d5c6195bcf407cb073761f8a4f30a4061f136

          SHA512

          e841cd9283c63a92395b4221492e2ae6b06d9c4108fcbbfe7d8a7928cfca405c14c0634a6388a4f18da3db611696ea797f9b825ed314d1640a17aa767593e412

        • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

          Filesize

          338B

          MD5

          d0eca34489c003255da2ab93c491e6ee

          SHA1

          a72bb0bf2f8b425f905b8357545b22db3e42821b

          SHA256

          a389de244b8ffcd8dcad2dc138e688439d682c61c5114ce5ef3d31f28145cedb

          SHA512

          a5b826a94bfae596d138a8fead4aadfa0ea7ac029e643c700485a16d014222862049efba8b9e1a4bb6a1694cab6a0c743e9b959763dd8a9d91b6bb7ae36fe670

        • \Users\Admin\AppData\Local\Temp\biudfw.exe

          Filesize

          105KB

          MD5

          21547521a6fd3879a82439960675de00

          SHA1

          b1d9197b022d8f214c69953ee8f0c1801994a563

          SHA256

          e7edd3eae7e3566670fa409808132264c3bb0f07d087acabe0cedf371af8b2b5

          SHA512

          71340bb609679abf1c1cd69dd786ed295a7d20d860a1da18912c3df796cc8bcd10cfd00930298f6f0c2358fa47c5c49e0623bed2e9f2eaad1b71d9a282fda2de

        • memory/1956-0-0x00000000010B0000-0x00000000010D8000-memory.dmp

          Filesize

          160KB

        • memory/1956-17-0x00000000010B0000-0x00000000010D8000-memory.dmp

          Filesize

          160KB

        • memory/2624-9-0x0000000000F70000-0x0000000000F98000-memory.dmp

          Filesize

          160KB

        • memory/2624-20-0x0000000000F70000-0x0000000000F98000-memory.dmp

          Filesize

          160KB

        • memory/2624-21-0x0000000000F70000-0x0000000000F98000-memory.dmp

          Filesize

          160KB