Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 12:19

General

  • Target

    01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe

  • Size

    92KB

  • MD5

    01fd4daa9eaf6bcc9cfaa37efa2f3430

  • SHA1

    fddfd69cb7fdec778088ed568656103c62c3e85f

  • SHA256

    8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94

  • SHA512

    fcdc4890fd25dd58648a0d6602ca130f2c61efcce12f31377b3cb2955758491e7fd1fbae5b4a1a060fffe9028b2568a443450abe189529b3bd7ba4de9350ab87

  • SSDEEP

    768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4Us:OVNSf7hyk+I6412V6PMqAax80XAFSrR+

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      PID:1688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
        PID:3900

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      d8c69e006046149f40585fb3e1bfafb4

      SHA1

      97073fb1d116248dbecd009e4bf873ab45c6c2da

      SHA256

      df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

      SHA512

      b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

    • C:\Users\Admin\AppData\Local\Temp\huter.exe

      Filesize

      92KB

      MD5

      684f34226d1c582436a1caf5ffbede20

      SHA1

      f7f8603176bf0eb6ee8305e385d706e9df283b6d

      SHA256

      c77c1b9fc89a0bf7434d69586fdcf672ac07611cc1d915e0ff17fc8eb703bbb5

      SHA512

      5934251703861616d2b2812416fc5d2bace7aa277964fc6e48e72299b7b337fe672c60f080b7b3ffcc97a7e9dc428bd97358ee2fa16919ebf3034968c7a59a5b

    • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

      Filesize

      304B

      MD5

      9b6e321710b30ad900aa92e5cb30d191

      SHA1

      e09bf7d2dc2af6b1ac030c9853a9639582c26888

      SHA256

      84fd1df0d46564fafc29f3ed7b9e1fdf0f02dbbdd80166c1a713c4519c114f28

      SHA512

      42d07d99d6d6e80bb85a7e09b5eb374b727182af1ee44b7893367d4406eb751b61a28ad2591be9f0cb455dd6849a1e90f3b20ef210079be89eb951e4aba31a7e

    • memory/1688-14-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1688-20-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1688-22-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1688-28-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/4964-0-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/4964-17-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB