Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/03/2024, 23:36
Behavioral task
behavioral1
Sample
b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe
- Size 365KB
- Sample240327-3l17csdd95
- SHA256 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116
- MD5 40fc178bdd90bc1b2d4bdc19cbf3ad1a
- SHA1 19dc8230ea23db3b82a2e81888e14833e4982172
- SHA512 bf25b5f518b46120a3e3cce26d5e34872a561416684822c6d903c69e22db734c3f02725f38443f27b0c72f2d5299599fed5deb63d641928e96415b0b2192dee3
- SSDEEP 6144:OuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pe:OzGL2C2aZ2/F1WHHUaveOHjTy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.165
-
218.54.31.226
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation dyawv.exe - Executes dropped EXE 2 IoCs
pid Process 4564 dyawv.exe 3212 cihor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe 3212 cihor.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1672 wrote to memory of 4564 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 89 PID 1672 wrote to memory of 4564 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 89 PID 1672 wrote to memory of 4564 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 89 PID 1672 wrote to memory of 2512 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 92 PID 1672 wrote to memory of 2512 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 92 PID 1672 wrote to memory of 2512 1672 b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe 92 PID 4564 wrote to memory of 3212 4564 dyawv.exe 100 PID 4564 wrote to memory of 3212 4564 dyawv.exe 100 PID 4564 wrote to memory of 3212 4564 dyawv.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe"C:\Users\Admin\AppData\Local\Temp\b7ba70b11e59f101cba1cd141c109b1f6f3728d78df1838e518a5810c969c116.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\dyawv.exe"C:\Users\Admin\AppData\Local\Temp\dyawv.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\cihor.exe"C:\Users\Admin\AppData\Local\Temp\cihor.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 340B
- SHA256 f2b1313efd177bfa82496cd66fcbc78818d424c184869178a2fe3ba64f5a91d2
- MD5 7692f8f34252e7f99b3a480da5e5ce42
- SHA1 5664976a7d9e467b15045bfd91181a0641a0baa5
- SHA512 769f58a4c8e204d25d774e47b752a822c055a8bb73d7fdfcadecac647e363407453c90a43446c66c109d88dba7155b27e7549b59979ecc4302767fe2d63b6e49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\cihor.exe
- Size 303KB
- SHA256 8e7d4673f3ea1f934651b10a8ff779e2b8ba15530e17f1a2632840a082b143e4
- MD5 0d771a08d9ca877d1dc6bd24f16e3c95
- SHA1 f016b0db6bfe104d6ce87f92214a228a92ef0305
- SHA512 e6faf3245ef4f82b41a40b8cd26391f8b9ec7aad2a790874d6a96e34dcaf1ba0788735c714cef6d21fa9db7428dba4097576d1d869e7906833f342040cc63fe6
- SSDEEP 6144:ddI/RDUXW62fs1FbIbrvBcVPH0T5J5ZtmOZpw:XI/RDUm/S5IH57/o3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dyawv.exe
- Size 365KB
- SHA256 a238955d730e89cc6c9c5b80eecb0f871ccdc16f23f8f9f02918a9a34e711e46
- MD5 7a658c1d35de0bc41c993aa111ad0e56
- SHA1 28151bbf24a5cc2d1491e286a5ccd54d161a40f7
- SHA512 5d5b65a8b16dfab5019aeee3db7557494852f9fecb32bbc487f1824459d70917447337710415ac0a0b22efb50abe7fcf72371dd37b57345c4752978030a0f2fe
- SSDEEP 6144:OuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pK:OzGL2C2aZ2/F1WHHUaveOHjTG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 9e5c3d332593a487f1e515df40d9af34611542495ac56032a63d48abf559ea53
- MD5 15c727247679e86d63bd490eefb29877
- SHA1 5275263f60e78c10b9c01098647896deb223f2f3
- SHA512 42f516a213ca635ef39b5a2d782ec3384518a41d70b80df67a0e9fc723f7023769af8d2db617adbc4d32f03aaea7f6d8604b8292d0b76b1afa5a801c8425abf0
- MD5 SHA1 SHA512