Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
28/03/2024, 00:27
Behavioral task
behavioral1
Sample
d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe
- Size 468KB
- Sample240328-arw6dahe43
- SHA256 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495
- MD5 33b510c73f5209cb1c1dee94e61fa23a
- SHA1 21f983a5d601aaac2da1c89cf3bcbaf8dc3777d7
- SHA512 8f59f6e9fa8c29f3e68c26b873b9e222c4a8be74ef60b1471655212f89c309b8f86aa07295b3be613722339a6116a8d930a8865446915c9e9daecc6f3be60d4b
- SSDEEP 12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1Ux:Y6tQCG0UUPzEkTn4AC1+m
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
urelas
C2
-
1.234.83.146
-
133.242.129.155
-
218.54.31.226
-
218.54.30.235
Signatures
- UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/files/0x0003000000000733-21.dat UPX behavioral2/memory/1568-26-0x0000000000400000-0x000000000049F000-memory.dmp UPX behavioral2/memory/1568-28-0x0000000000400000-0x000000000049F000-memory.dmp UPX behavioral2/memory/1568-29-0x0000000000400000-0x000000000049F000-memory.dmp UPX behavioral2/memory/1568-30-0x0000000000400000-0x000000000049F000-memory.dmp UPX behavioral2/memory/1568-31-0x0000000000400000-0x000000000049F000-memory.dmp UPX behavioral2/memory/1568-32-0x0000000000400000-0x000000000049F000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation zidiw.exe - Executes dropped EXE 2 IoCs
pid Process 3192 zidiw.exe 1568 oqivf.exe -
resource yara_rule behavioral2/files/0x0003000000000733-21.dat upx behavioral2/memory/1568-26-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1568-28-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1568-29-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1568-30-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1568-31-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1568-32-0x0000000000400000-0x000000000049F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe 1568 oqivf.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3560 wrote to memory of 3192 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 86 PID 3560 wrote to memory of 3192 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 86 PID 3560 wrote to memory of 3192 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 86 PID 3560 wrote to memory of 1316 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 87 PID 3560 wrote to memory of 1316 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 87 PID 3560 wrote to memory of 1316 3560 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe 87 PID 3192 wrote to memory of 1568 3192 zidiw.exe 97 PID 3192 wrote to memory of 1568 3192 zidiw.exe 97 PID 3192 wrote to memory of 1568 3192 zidiw.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe"C:\Users\Admin\AppData\Local\Temp\d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\zidiw.exe"C:\Users\Admin\AppData\Local\Temp\zidiw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\oqivf.exe"C:\Users\Admin\AppData\Local\Temp\oqivf.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "2⤵PID:1316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
- Size 340B
- SHA256 902cc8a26e1eefb6d2b07c7dd1d8fb0f42ca552fabe5e40f739766fe133d834a
- MD5 5a92408a933e70f6a209295ec2df0818
- SHA1 79b31560a7225c398a796f07a45d9f449c667f72
- SHA512 d0a58fa5fa0eb7f3b9ac74627511b8f933a67f835db0fc6b908c8457313a2b13106d33d6ef46cdbe99ab964733fbb79a362cf6c492e0f6b14fb137db04bcc9c2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 14d4181a674638119a5016e67dffe63b572795b253baa755cecdf4b1b14053fd
- MD5 2bc4dbf0592ac5393c114bc644da244f
- SHA1 c1f4f9dca778a5fb49227c1157f0ed612348f982
- SHA512 b606558a1c36d11d42ff6272500430060fb814193129ba6155ab4e9eb516ba8e73f1ab145475a2dd6adde7b3bd6521d095b97541ecfff14ad64eb87d9ca49a8a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\oqivf.exe
- Size 198KB
- SHA256 8b9f5a0a24beb0c13ad8da42d7950f7e694525c6f78660e2fe4c2fe4c9380345
- MD5 bc1513b2e050f4ba8cfc909c658dbff9
- SHA1 da0e5f55e5b894e3ddba677651dc03cbf6040105
- SHA512 4d6ca5fdeef442d530576d7e84d1c41753c3f3083b0e5c1cf17218bc98f884bb71cfaa40eb99a3aab85a9de58e448618f0af4528b4e4dd64367fe61fdb523d9f
- SSDEEP 3072:dLeZUwofc1zU9KUgshNIFfF7eO+blJULGaMl1+jhh+PaWY3P2lmWtoutA78:pXw5MK1shNIFfFCULGvU+3VlBtoSA78
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\zidiw.exe
- Size 468KB
- SHA256 51d051cfb385147dbb9923bb6d15e9637d63b87866d9536030839688b7ff6421
- MD5 35b2d98a0854e972c3346667f2dcb6cf
- SHA1 30edb847c1115336eaaec0fe5c58d76b70952ac0
- SHA512 0baee6277eeb4e8fc98e9d55a7a58679a2abd9d823307923dbcbbc38beb5111c1c89fe1173f9736f1c6773f467fe75a3c6cabebd5f7c1a1b43181b866abf6e1e
- SSDEEP 12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1Ur:Y6tQCG0UUPzEkTn4AC1+0
- MD5 SHA1 SHA512 SSDEEP