Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/03/2024, 01:36

General

  • Target

    cf98e1c96efb311bbd871d0e2b974135.exe

  • Size

    402KB

  • MD5

    cf98e1c96efb311bbd871d0e2b974135

  • SHA1

    03e7db2575c8f88ee65107f33d9a260a15ccdb0f

  • SHA256

    d14e7af0587c40e259d8b3400b9754d2df6359b3df0e522d261c9b9d117d3167

  • SHA512

    d7f2ffffcf4294fa8451ab71a018bd8f269c6895739ffd44868f075bc5ad7e7c7e0f8fd224c2e3cad3a60f3dcbedc5b965d99fd349632ab4997d085686cec934

  • SSDEEP

    6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBroh2:8IfBoDWoyFblU6hAJQnOg

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf98e1c96efb311bbd871d0e2b974135.exe
    "C:\Users\Admin\AppData\Local\Temp\cf98e1c96efb311bbd871d0e2b974135.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\ajsof.exe
      "C:\Users\Admin\AppData\Local\Temp\ajsof.exe" hi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\azyjhu.exe
        "C:\Users\Admin\AppData\Local\Temp\azyjhu.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Users\Admin\AppData\Local\Temp\jifij.exe
          "C:\Users\Admin\AppData\Local\Temp\jifij.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1236
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
            PID:2040
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
        2⤵
        • Deletes itself
        PID:2656

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

            Filesize

            276B

            MD5

            36c9bf4a55cb8300c6139f9307c087b4

            SHA1

            f02fac771ac36c38d63174907ce30d8272a9960c

            SHA256

            3c6c5d512387419fec7f9e766ab4d85a515748b908e0e91f999fd45b584443e1

            SHA512

            71af02057fe77265d918bf6c06d7414b4f0208ee971ead4101f1f719c614c67a711666ffab32eab5af1f5302b507e30b2da0a06b5b7870cff54b001408df259c

          • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

            Filesize

            224B

            MD5

            161e3775e241a787082aeb2e66a94e99

            SHA1

            c4d097fd4df7053acf15ae5982c4fb74d57159e9

            SHA256

            6f770f463c62c890f32046afe19b6714a365201fb2ba442725a56a9b3cde8e34

            SHA512

            350ec03a3d5909b05a9942cf88471d6215595a79603b19ddcf19f7e8a6e3fdc379f0417e53d01a6ca2d936f53ab27a3f43f1ad224b98f2568ac7892fd79dd4a7

          • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

            Filesize

            512B

            MD5

            004fbe7531846998273fa0f9a150bd5d

            SHA1

            2a80262a40599b131e39bdf93bde50105667c151

            SHA256

            da90476b573af311f9491b02be95d18c26019e7c3037ca76f74b4d650aebfb1b

            SHA512

            47fc50f1f90d8e065631cfa678c642be869663a9e023b0caca16f8cd3d7dc0074e37842b8bb719728e9a842d2083420316c618760af3b9e0c803a2ea31a5fd4e

          • \Users\Admin\AppData\Local\Temp\ajsof.exe

            Filesize

            402KB

            MD5

            9988d74b0b0eec5860390da023ac7cc9

            SHA1

            86bd4f60a55e2c112eb065cf539db6556dd92acb

            SHA256

            49bc0ca57b24ed7754e965e2d9ca15d75cd7bd4153f4e82336270ba5bdc5bfc8

            SHA512

            1fda0f84a027300d9f33bbfed45d1506561dd14bdadec9ead6f9ca064d80cd37ca95ee3f8ba51f7e9df134ce315ccbc2373b7b19d9dd0638cf8f769de18bffb8

          • \Users\Admin\AppData\Local\Temp\azyjhu.exe

            Filesize

            402KB

            MD5

            d170e20e8f3738165fc0f8b5df188490

            SHA1

            ee9876568c232fb1ebb9412ef34a1e0e8b122e25

            SHA256

            465e05056d17a858364dd23c9a653db1d77bd445fc98ce14d97f9a5279188363

            SHA512

            0adc977f22ead660184298582f01d17d6c64e6742f0a4468869183130e3b777323a19ee1dc81238d5a5d636fc21e8edd40ed46c1a9a0011dbeca70bcc239f803

          • \Users\Admin\AppData\Local\Temp\jifij.exe

            Filesize

            223KB

            MD5

            4daa1f8aeb1f6012b0a222d5654f6984

            SHA1

            50b40350c694833b6026169a357a873d45be1483

            SHA256

            cbdb5ee3f06dfd7f45724995a54bdd2a176c02d1dd4822dd7a8ca94e7647e1b5

            SHA512

            b40e37b90aff3d9e1758c01c3db8c496ae5f723872799ccb133eb89128a50f29752b0d5f7c80feee97ca447eb625afd3209f86dcd9767217a75533110e1e6784

          • memory/1236-62-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1236-61-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1236-63-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1236-60-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1236-55-0x0000000000020000-0x0000000000021000-memory.dmp

            Filesize

            4KB

          • memory/1236-54-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1236-59-0x00000000000D0000-0x0000000000170000-memory.dmp

            Filesize

            640KB

          • memory/1944-34-0x0000000002280000-0x00000000022E8000-memory.dmp

            Filesize

            416KB

          • memory/1944-35-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/1944-21-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2096-44-0x0000000003AC0000-0x0000000003B60000-memory.dmp

            Filesize

            640KB

          • memory/2096-52-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2096-37-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2276-1-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB

          • memory/2276-7-0x00000000028E0000-0x0000000002948000-memory.dmp

            Filesize

            416KB

          • memory/2276-23-0x00000000028E0000-0x0000000002948000-memory.dmp

            Filesize

            416KB

          • memory/2276-22-0x0000000000400000-0x00000000004679C5-memory.dmp

            Filesize

            414KB