Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 12:19

General

  • Target

    01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe

  • Size

    92KB

  • MD5

    01fd4daa9eaf6bcc9cfaa37efa2f3430

  • SHA1

    fddfd69cb7fdec778088ed568656103c62c3e85f

  • SHA256

    8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94

  • SHA512

    fcdc4890fd25dd58648a0d6602ca130f2c61efcce12f31377b3cb2955758491e7fd1fbae5b4a1a060fffe9028b2568a443450abe189529b3bd7ba4de9350ab87

  • SSDEEP

    768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4Us:OVNSf7hyk+I6412V6PMqAax80XAFSrR+

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      PID:1384
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      PID:2196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    d8c69e006046149f40585fb3e1bfafb4

    SHA1

    97073fb1d116248dbecd009e4bf873ab45c6c2da

    SHA256

    df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

    SHA512

    b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    304B

    MD5

    9b6e321710b30ad900aa92e5cb30d191

    SHA1

    e09bf7d2dc2af6b1ac030c9853a9639582c26888

    SHA256

    84fd1df0d46564fafc29f3ed7b9e1fdf0f02dbbdd80166c1a713c4519c114f28

    SHA512

    42d07d99d6d6e80bb85a7e09b5eb374b727182af1ee44b7893367d4406eb751b61a28ad2591be9f0cb455dd6849a1e90f3b20ef210079be89eb951e4aba31a7e

  • \Users\Admin\AppData\Local\Temp\huter.exe

    Filesize

    92KB

    MD5

    f5d943978595a5176fe6aee3aca57157

    SHA1

    88096c8297ec5101fe1c06c464f03fe3275f778d

    SHA256

    af3d47c96fbc712ba82df328a7651419337703ca4965eed1e544658b686c672b

    SHA512

    f3aeb079ac8225af6717803714f66050a72f73601b5108777c524f3182a36108cfd030be527d6f420e73cc24949c236070b3a1d4ff0b5561bf1d86594259078c

  • memory/1252-0-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1252-18-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1384-9-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1384-21-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1384-23-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1384-29-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB