Malware Analysis Report

2024-09-11 13:30

Sample ID 240613-3k4k4avhpf
Target 64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10
SHA256 64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10
Tags
urelas trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10

Threat Level: Known bad

The file 64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10 was found to be: Known bad.

Malicious Activity Summary

urelas trojan

Urelas

Executes dropped EXE

Deletes itself

Checks computer location settings

Loads dropped DLL

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:35

Reported

2024-06-13 23:37

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\badou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jygaq.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\badou.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\badou.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\badou.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\badou.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\badou.exe
PID 2904 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 2904 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 2972 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\badou.exe C:\Users\Admin\AppData\Local\Temp\jygaq.exe
PID 2972 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\badou.exe C:\Users\Admin\AppData\Local\Temp\jygaq.exe
PID 2972 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\badou.exe C:\Users\Admin\AppData\Local\Temp\jygaq.exe
PID 2972 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\badou.exe C:\Users\Admin\AppData\Local\Temp\jygaq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe

"C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe"

C:\Users\Admin\AppData\Local\Temp\badou.exe

"C:\Users\Admin\AppData\Local\Temp\badou.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\jygaq.exe

"C:\Users\Admin\AppData\Local\Temp\jygaq.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2904-1-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2904-0-0x0000000000FD0000-0x000000000105F000-memory.dmp

memory/2972-20-0x0000000000020000-0x0000000000021000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 3256c70f9911bde58da3b256ab7ca9f0
SHA1 c975fdc479150bd7c2cb8c8e618a3eb25e165510
SHA256 7d3a267d4ff5c05d414eef157986ad40e08afb388d29c0ca9992109247bb103f
SHA512 76c5d630f0553903c3c70dcff156b097812fad2f6b72459ab9949eac80d05c1a568af8569fcb4a4e1a46ba85cb21f2171a6fdd4bc137b594306f8b404caeb450

memory/2904-21-0x0000000000FD0000-0x000000000105F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\badou.exe

MD5 1c471aec96f47aec7c05539fdbeba5fe
SHA1 23e5206a7ce9021b682397a2bb3ec2736676f5b9
SHA256 a2e355984aa9da83c3914bb38f317fa8d9570e8f29825748694142070b922a41
SHA512 d250b40a4a5e488581aa7752525437c483d1441f8e4c65ab2614f4cd30f223dbfc1769ed75d4e312521cdf6fa8e62ce260237012186c4deff4b1281f0383ffda

memory/2972-19-0x0000000001060000-0x00000000010EF000-memory.dmp

memory/2904-17-0x0000000002520000-0x00000000025AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 28211a53283bcc8ae3af7f0c29d33f40
SHA1 2d68172e7c327faede3a6103bdfd10197a8b4fd1
SHA256 484ccf8cf3cf095b29eaa79e544482263e20dd007858a3980685058dabc0f2b0
SHA512 68be59af8ec0259d42ac11a838c908c7e4f6b027fb292eac71e853acfba3f1dc6ca024dfc8e8efacc64f05309dbfdb2cff0ec962457b029c9221dbce0b65a6c0

memory/2972-24-0x0000000001060000-0x00000000010EF000-memory.dmp

memory/2972-26-0x0000000000020000-0x0000000000021000-memory.dmp

\Users\Admin\AppData\Local\Temp\jygaq.exe

MD5 551e39605ec6a2ce01f63140c3cc22c1
SHA1 3635ff04e04b20d1fe8fe3623d8d4db100ba9d04
SHA256 74b4c9087d88e18b6b425ae2bee9feae21a15bc6b3477f3adb3f2b01bc8a7ce5
SHA512 800e532df810575ea3178becc76f7eab5f792c4bc168a636002e4fe9bd05f41e6a17d7a5f903df87a56a81822c382d385d15fd3a0ca466ce7c748d458825c1d8

memory/1872-43-0x0000000000D00000-0x0000000000DB3000-memory.dmp

memory/2972-42-0x0000000001060000-0x00000000010EF000-memory.dmp

memory/2972-39-0x0000000003D30000-0x0000000003DE3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:35

Reported

2024-06-13 23:37

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\wavux.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\wavux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\gehed.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\gehed.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\gehed.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5104 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\wavux.exe
PID 5104 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\wavux.exe
PID 5104 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Users\Admin\AppData\Local\Temp\wavux.exe
PID 5104 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 5104 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe C:\Windows\SysWOW64\cmd.exe
PID 1832 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\wavux.exe C:\Users\Admin\AppData\Local\Temp\gehed.exe
PID 1832 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\wavux.exe C:\Users\Admin\AppData\Local\Temp\gehed.exe
PID 1832 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\wavux.exe C:\Users\Admin\AppData\Local\Temp\gehed.exe

Processes

C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe

"C:\Users\Admin\AppData\Local\Temp\64cb9b1354a44abee386b4f2259608a815de3543f518c9715484d2ce0b59cf10.exe"

C:\Users\Admin\AppData\Local\Temp\wavux.exe

"C:\Users\Admin\AppData\Local\Temp\wavux.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\gehed.exe

"C:\Users\Admin\AppData\Local\Temp\gehed.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2452 -ip 2452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2452 -ip 2452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 256

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/5104-0-0x00000000002F0000-0x000000000037F000-memory.dmp

memory/5104-1-0x00000000009B0000-0x00000000009B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wavux.exe

MD5 7cf151379857e47c1006c6b40d4ddfcc
SHA1 1686f6d2ebdf14d13984fc7adb427896b601d425
SHA256 365d940880ae2c3120d31ee0ecb1419b10070ee0ff6dd0b60cb2790239ff8c02
SHA512 ec10aac75ed4dccedd5d975fec97d8009c6a93a174e6255d92b940a6a0c13c3da7edfc701d444847260032112728e77acd255fbde7b23585a847fded29ce638a

memory/1832-17-0x0000000001220000-0x0000000001221000-memory.dmp

memory/1832-16-0x0000000000D00000-0x0000000000D8F000-memory.dmp

memory/5104-15-0x00000000002F0000-0x000000000037F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 3256c70f9911bde58da3b256ab7ca9f0
SHA1 c975fdc479150bd7c2cb8c8e618a3eb25e165510
SHA256 7d3a267d4ff5c05d414eef157986ad40e08afb388d29c0ca9992109247bb103f
SHA512 76c5d630f0553903c3c70dcff156b097812fad2f6b72459ab9949eac80d05c1a568af8569fcb4a4e1a46ba85cb21f2171a6fdd4bc137b594306f8b404caeb450

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 3c711ae82c50645ed8a130fcceebbe4f
SHA1 2f0ef4ea8221aca775b8f00e941506aa7f179a29
SHA256 e800f78b48a069994acdb53aac83efcd76cda96423cbe49658ca3e0077b0c2b1
SHA512 0624123dcc6845ec2fca3f8331fccbca140a005cac8deed881b605874f235aafd68281f01524ffc01db552d59251c34507dc42ca0b4444ba85cc5ac13e6cdb35

memory/1832-20-0x0000000000D00000-0x0000000000D8F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gehed.exe

MD5 176c546b097319516a20d492e0d0df63
SHA1 d703934fb3c3886a70200214f6638e61eee12eaf
SHA256 62d83cfbe9b49000cf82a2693b368541bc1634b82f0054bc3b7dcaeba3f6fe0d
SHA512 73a1e64ed4d68ab224bfd533d60227a62745b563af2c8ba3a4d346d12f538f9e928ae27684e1a6392d634fd04ee9ab7996c3754395a7bd9e5073c22f8fa9701b

memory/2452-37-0x00000000001C0000-0x0000000000273000-memory.dmp

memory/1832-38-0x0000000000D00000-0x0000000000D8F000-memory.dmp

memory/2452-40-0x00000000001C0000-0x0000000000273000-memory.dmp