Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
23/03/2024, 18:47
Behavioral task
behavioral1
Sample
2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
- Target 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe
- Size 388KB
- Sample240323-xfl8csah36
- SHA256 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a
- MD5 eeda31c94956ce96561970e4c433a0bf
- SHA1 3be166d1f119763f4773d775b8f6addbce59c138
- SHA512 42b386c13bc459a4282da8a936ad1fd73ad5ef8a358f093f1e6474cda346d0d1410e10ac60eaa190a0fef7b3db6a4acb11ee7215792297a49a2cefe55e3476b7
- SSDEEP 6144:2xBWeMRygxDLbHxlSBxzJMotBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGtp1F6:G3MQIDKJQq+Xxvo0U+d3s/fCX0j
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
urelas
C2
-
121.88.5.183
-
218.54.30.235
Signatures
- UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/files/0x000600000001e808-20.dat UPX behavioral2/memory/1184-24-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-25-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-26-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-27-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-28-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-29-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-30-0x0000000000020000-0x00000000000DA000-memory.dmp UPX behavioral2/memory/1184-31-0x0000000000020000-0x00000000000DA000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation padem.exe - Executes dropped EXE 2 IoCs
pid Process 4800 padem.exe 1184 giowo.exe -
resource yara_rule behavioral2/files/0x000600000001e808-20.dat upx behavioral2/memory/1184-24-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-25-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-26-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-27-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-28-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-29-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-30-0x0000000000020000-0x00000000000DA000-memory.dmp upx behavioral2/memory/1184-31-0x0000000000020000-0x00000000000DA000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 4800 padem.exe 4800 padem.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe 1184 giowo.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1184 wrote to memory of 4800 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 93 PID 1184 wrote to memory of 4800 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 93 PID 1184 wrote to memory of 4800 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 93 PID 1184 wrote to memory of 2252 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 94 PID 1184 wrote to memory of 2252 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 94 PID 1184 wrote to memory of 2252 1184 2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe 94 PID 4800 wrote to memory of 1184 4800 padem.exe 115 PID 4800 wrote to memory of 1184 4800 padem.exe 115 PID 4800 wrote to memory of 1184 4800 padem.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe"C:\Users\Admin\AppData\Local\Temp\2884dc4aa3b8b68afb0d8438b3f462fd579786b6a84dc3af4109d133f6d18e7a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\padem.exe"C:\Users\Admin\AppData\Local\Temp\padem.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\giowo.exe"C:\Users\Admin\AppData\Local\Temp\giowo.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "2⤵PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat
- Size 341B
- SHA256 fcaa7caf9f92fa5942b2085ee639a1826561cd246503f8b5dcd2518d67494f15
- MD5 98621d2c349a302b2bed32719293b5b7
- SHA1 cf8b80443d023831d9add0e366c311a876ff3123
- SHA512 f555543415761ef2a8e3d946c37521de743526c5dfa62e0cf32c52c7494ed62dda76771d53f33d0a8ae2418d13a6f8db67386b92e76dadfdbc44fd79b006309a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\giowo.exe
- Size 243KB
- SHA256 77097e8ed314134fa63b20495ad8e65aed7146d43a03217b7dfd8c0b73995227
- MD5 02294233c8d5e8c0de6ebdf282b43025
- SHA1 e9e0605a5fbfb5719e22c52006ca557866850a72
- SHA512 45faaa56a70863e73a8b9bca5cc4001b38309139afc8f36021e5524f6af1ea3d9f02ef71a6ac321e598dd2e1f3a2a379603f1782f5033cc0c16376b5b107ce6e
- SSDEEP 3072:R06TPH0SrN3IHDGKGR9oKpPCR3lH1akXDMOEkXy0fgHOy7IZWIt/Te83bc:nrN3IHDGKy95pe3lMy/EA2uugt7e83bc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 af696ec1490674100d8c7ccc03cfdb1658a854253a952001ec064c645c7ed92b
- MD5 90f97c5551ecd9e3ffd773509fab8cf6
- SHA1 406bd556025bb19fe105a1a4ebb672340a9b94dc
- SHA512 9bcefa4af32e681b2f52560535bf04bb07b5e447ef58ca1f055c20ca8bb5ebc8c0351a5a3a05eb01c1daaa24f41f9856204cb65b04d297ce446eeda9fd46e2a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\padem.exe
- Size 388KB
- SHA256 16e5236b43a5d0346e5112ff2f31eecb5ea6576667636c9c8c6e97317167799f
- MD5 57d7848edda0d65199d849182aad8fa9
- SHA1 fd9fee88397611a327ce940f09b6ddb628a12823
- SHA512 4c58714e82d0066b66bfbce6613205a0056a99e0cb22c4e037b68fb246637d014fa700b135cbd008b3250eb964d5a439e29e363ea0b09fd0bdd549b0f8392040
- SSDEEP 6144:2xBWeMRygxDLbHxlSBxzJMotBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGtp1Fx:G3MQIDKJQq+Xxvo0U+d3s/fCX0k
- MD5 SHA1 SHA512 SSDEEP