Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/03/2024, 22:22

General

  • Target

    cf389a6edfd132de5bfeb2deb343d5e2.exe

  • Size

    401KB

  • MD5

    cf389a6edfd132de5bfeb2deb343d5e2

  • SHA1

    42a47204b264bf4c1bc00f38fb8a9b345dc40028

  • SHA256

    614c3bbd21decd89fa9045ef7960de748ddd0ab3574645441ca014f81e1002d9

  • SHA512

    92044df4ae0004069efe3ac598ad3dcc4414d5c4736143398200499d44c6402e0728dfcb8a9593a6f8e14ce96a9ac9f774451ae509a5d2eda724bbc523c9cfbd

  • SSDEEP

    6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohCR:8IfBoDWoyFblU6hAJQnOC

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf389a6edfd132de5bfeb2deb343d5e2.exe
    "C:\Users\Admin\AppData\Local\Temp\cf389a6edfd132de5bfeb2deb343d5e2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\exizj.exe
      "C:\Users\Admin\AppData\Local\Temp\exizj.exe" hi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Users\Admin\AppData\Local\Temp\quneah.exe
        "C:\Users\Admin\AppData\Local\Temp\quneah.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Users\Admin\AppData\Local\Temp\higov.exe
          "C:\Users\Admin\AppData\Local\Temp\higov.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1904
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
            PID:2412
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
        2⤵
        • Deletes itself
        PID:2532

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

            Filesize

            276B

            MD5

            f0a542051f587925e773aed510551c0a

            SHA1

            bd0f7fe15646e1bb9b381ce964be431b56c83189

            SHA256

            ab4e945db38780543ff3997c5e9e5e2c58e974caf1f8c8e540897208d1991f90

            SHA512

            c9109665f93150eb7eebc895c0ad5357500f3c8707cd5d50a9548a732e15bb9efa948570e4f72c80ccf8a0ddb152f8972a7e202ada6faf05c1f877ce8c6dcc26

          • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

            Filesize

            224B

            MD5

            dfecc9686f56f40bd7bd79b69f9c43bb

            SHA1

            3e94767cb5d7bd7cfc00965fd32041a99fa6822e

            SHA256

            038d99a8b5b0141f780250a1a86cd7c969263ebf18dc8539b89f0b6dff6cf2e2

            SHA512

            2b12fb561bc6005424da26dbacff65c1d9ff2de249b4d7255ad35152a63c95cf3571faee0752b90793bb11ef97087aaac5648913bd374f13cdda24a001cfa116

          • C:\Users\Admin\AppData\Local\Temp\exizj.exe

            Filesize

            401KB

            MD5

            5a9568a8db95af832bac7903cdab2eea

            SHA1

            133e36356ebc3c99808fb6c21ffbfaee52605ecf

            SHA256

            afb89bfe1d09cae0e9c0c8265aabcd9f05dedd1428730467ef7ee3227efc02eb

            SHA512

            b0c177b2603b652ee36cfb1824e5c654df5be1ab288bc750ec693528ebdb83756a2714d696f150f0004c118ddfbec4b7f2adc8098ce0ca07536b3620df84e794

          • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

            Filesize

            512B

            MD5

            8597b27c3ba89aac3aec691f8ef9d237

            SHA1

            8ee9089671609eb1d4eaabe1b0786abccbfedf2b

            SHA256

            2acfe09400322b1389b8e2c1a6ffe3734aaae6835bd1ac6839956fab25ef3337

            SHA512

            a351f0be3182d9a8ebf80676ea9408ba54fff9abcc9f6970f62d4f3d94717a55a35802291cd82d7b0bd513f8e3eb162fe6773a3d65380ed9345d8557f0b95921

          • C:\Users\Admin\AppData\Local\Temp\quneah.exe

            Filesize

            401KB

            MD5

            e704188fe23337989ae3292c82c8bbfe

            SHA1

            635a70acc93d1946f921750eadf9ceb1a21d86cc

            SHA256

            481d648b2f1bcadb3dd7fee44a1872369690e15218ad829876fdcdb27716bb59

            SHA512

            a832b1a179894444403f7a911f8606507096061d3fe100d32e7accd4b7983942857ecbdb44f5a8b9255cc4466490a97e650285e6a332b2b175ca4be6b65a23ab

          • \Users\Admin\AppData\Local\Temp\higov.exe

            Filesize

            223KB

            MD5

            fe3af1797945ecdb8528731f06d57fcc

            SHA1

            01bbfcd082ecde962e4db36013e068f3465a8f63

            SHA256

            88c665becd36e6dfb4673e9f8fc6389506304ae2e8baab095acecdd71c2a98dd

            SHA512

            fe171a3d4d704ddae7906e36c330d257cc2081f193f14e39af94886288999ddb87c7eb500ed2afc66e19310867bfc5b4f4218741c8f470d74dc58b37065c8468

          • memory/1904-52-0x0000000000020000-0x0000000000021000-memory.dmp

            Filesize

            4KB

          • memory/1904-61-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/1904-60-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/1904-59-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/1904-58-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/1904-57-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/1904-54-0x0000000000E70000-0x0000000000F10000-memory.dmp

            Filesize

            640KB

          • memory/2376-33-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2376-25-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2612-23-0x0000000002840000-0x00000000028A8000-memory.dmp

            Filesize

            416KB

          • memory/2612-2-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2612-22-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2624-51-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2624-40-0x0000000003C10000-0x0000000003CB0000-memory.dmp

            Filesize

            640KB

          • memory/2624-34-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB