Analysis

  • max time kernel
    89s
  • max time network
    84s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 22:38

General

  • Target

    5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe

  • Size

    56KB

  • MD5

    5f23c5fe29d4e99c992b6c5bb69799e0

  • SHA1

    77498d7bcd1a2292f5bbde0ccf6646c406da2cd8

  • SHA256

    270b2bb94948fc12d73c9cb6766a4b9920e22172e8400afc13d5db4da533e621

  • SHA512

    75e090a5a905e946357e87eeb9ba74a770b7b61201ce07cd38af6a9f80ec1c09fee88fb297edb555cfacefe845350d72f427d408fd3fa90b63a66d413b99ff99

  • SSDEEP

    1536:6W82C0Db1edMckBI1kmJAhTPY6pnouy8W:6n25DbaMySmJAhbvoutW

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5f23c5fe29d4e99c992b6c5bb69799e0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
        PID:1672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

      Filesize

      56KB

      MD5

      aa69678950aeb5442ae7937687d4393a

      SHA1

      69e3cb0644af48b83a1562eb09020383812b8966

      SHA256

      e996e8e08852163b9c06ea3d3c47b56b838e7cd636d2ba2f4e97d984beed9b28

      SHA512

      df2d86c48a0eead97215cc20474422c61e9f5ee8840804cab54eedabe45f1255a8c90a4a5caa56b2bbd3c31674b205c6bbbbca062227872f926b0fcee96dda65

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      b4a86880004da8726288d7ec954885a8

      SHA1

      1bab1cfbdc2c540246210bc7852f8fe7e8357b31

      SHA256

      c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46

      SHA512

      22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4

    • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

      Filesize

      304B

      MD5

      3f149920e4d09e8d64558827835cc9af

      SHA1

      dea72bc644c12b27fbfb3236e74b009b0ad7269b

      SHA256

      f3b5c3f2d164ea317e03dd92a8f2c32ead90dd248bfa4b59cdbebabc6040bb8b

      SHA512

      2f41fbdf2c99834d10fc93b9e2158bccf88997697c8a4154dbe56262ba4ad007668dcc210fbb73aee899e95c2c1bd628c0b9ed9e0e7787cfc03906b4199f9f77

    • memory/2012-12-0x0000000000330000-0x000000000035C000-memory.dmp

      Filesize

      176KB

    • memory/2012-18-0x0000000000330000-0x000000000035C000-memory.dmp

      Filesize

      176KB

    • memory/2012-20-0x0000000000330000-0x000000000035C000-memory.dmp

      Filesize

      176KB

    • memory/2012-27-0x0000000000330000-0x000000000035C000-memory.dmp

      Filesize

      176KB

    • memory/2120-0-0x0000000000CE0000-0x0000000000D0C000-memory.dmp

      Filesize

      176KB

    • memory/2120-15-0x0000000000CE0000-0x0000000000D0C000-memory.dmp

      Filesize

      176KB