Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 05:44

General

  • Target

    1e805c0b8a34c6295ec6e7d02c0f0539.exe

  • Size

    342KB

  • MD5

    1e805c0b8a34c6295ec6e7d02c0f0539

  • SHA1

    79ab51cb5f5b2b4141eb1a3ec88ee45aca06d027

  • SHA256

    c696b1ba3409aa799769815a4bcc1da27e52e80b8fc2731d6e1713ff52be9160

  • SHA512

    38a508d1100e91f4845b6933dfc432d4c8ef658da1d2bc817cc7dfb3e4e17c4386fb4685e8a3ffb4cc6a312853b81ee49be8c97e0758ab68aabd445f286dadea

  • SSDEEP

    6144:Nd7rpL43btmQ58Z27zw39gY2FeZhrL8Jt:X7dL4AZ0U9gY2Fhz

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e805c0b8a34c6295ec6e7d02c0f0539.exe
    "C:\Users\Admin\AppData\Local\Temp\1e805c0b8a34c6295ec6e7d02c0f0539.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\codum.exe
      "C:\Users\Admin\AppData\Local\Temp\codum.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Users\Admin\AppData\Local\Temp\ajlisi.exe
        "C:\Users\Admin\AppData\Local\Temp\ajlisi.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Users\Admin\AppData\Local\Temp\filed.exe
          "C:\Users\Admin\AppData\Local\Temp\filed.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
            PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
        2⤵
          PID:4776

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

        Filesize

        276B

        MD5

        2b304a44c6cca72085cf0b05f7aa3795

        SHA1

        32000767f611829ec66aead42dccf9a2d601d972

        SHA256

        4b74b0bed07c35ac6fbe5c275f96a8f06b81a1f32d93e2390ae1f1c2e7cf71e8

        SHA512

        40aac327cbc311cd1a3d33c6fd6f6666a255a2eda96dcaeef406ee7a5bc6bdaef8cf870266c351484c2c7fa3c294c40bb11c28ba616458a2e4ee0c5432000d1b

      • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

        Filesize

        224B

        MD5

        cc8df6f29246dee6df6f7eebed3f5745

        SHA1

        bb5775dab6e8b45fd362add783cb76ab09050568

        SHA256

        d23ebb7464d9db8268131685e425d3a3019a1d123980a203fca1a7f2d47eb296

        SHA512

        7e4c9571856d4fd73cb313a3daaf584d1c408812c6cb2119eb4dd9dd2264c68faf3cf0187efc34e103faf032cd09bb2fbc1343b1dc293a1d44b1ec238b184ff0

      • C:\Users\Admin\AppData\Local\Temp\codum.exe

        Filesize

        342KB

        MD5

        1352eedeee97d1b612a365045754df06

        SHA1

        d52c87e85c51f9a0adf7bd17807a2e2fb070c043

        SHA256

        e67c3bb9012e1e1b1ef67ae99c0b6cdc489cebf37d5152ea0ee6ffd49fc8f79d

        SHA512

        26fb255f8add5d684d885d6287bc1344d47c03620eb13f1af4eb05722e12c53436be63781642b6667fefb4d18cacf1755ad430b88574de6a9e8ca1e78ff769b7

      • C:\Users\Admin\AppData\Local\Temp\filed.exe

        Filesize

        136KB

        MD5

        739e35984ed54c806e950c7290b94274

        SHA1

        5b56327d36eb2ce3c2cdec4e511a776a85eb4e0c

        SHA256

        541efd367be3f69683d70d394d57e812c659e56c48bd608b5b028e6e9a18fc57

        SHA512

        0d1d81bab6e2a6cb25b0f31528c6921ca3cc0cfbe509dd684d1dab3879ae54d052035cc0bbb41e3cf797cc3c41117de4a68ce6a21df907f32f4f309cb33c8485

      • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

        Filesize

        512B

        MD5

        bbd575a4c13d643137491b0dd7d91b84

        SHA1

        39871f59de696d369c94dad686773805985daed7

        SHA256

        e2dae17b6be9459107b2dee69997a4097a8b0ccd1584a181f27d10eec096f5c7

        SHA512

        f257a24f3131edadd554f615615800b211cb9a50160d42d664221f9081417485da5445126aaa0acb081812880f7a463958583fb0001168c2be17ffdaa7ea2802

      • memory/1380-14-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

      • memory/1380-24-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

      • memory/3772-15-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

      • memory/3772-0-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

      • memory/3872-46-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-43-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-39-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-41-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-45-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-47-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-48-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-49-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/3872-50-0x0000000000D60000-0x0000000000DEC000-memory.dmp

        Filesize

        560KB

      • memory/4636-42-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB

      • memory/4636-26-0x0000000000400000-0x0000000000458000-memory.dmp

        Filesize

        352KB