Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
24-07-2024 17:42
General
-
Target
7Y18r(156).exe
-
Size
338KB
-
MD5
4b618ee7eb34d9776481ce7809bf23c0
-
SHA1
50be72c1861ba577f12872fe5f068a674afe91c3
-
SHA256
699128c70cc5be077b4dfa9b30776b3f7735fa678da85284c671c5654c94609c
-
SHA512
58ef134e82912754e09775b9ebdb99828cf81fc8a432e3f20e015e0ed4ad98fcf6fbca9127fe0a6b64099868e4ca1785a6d8c47d7ac853081e4392b800911110
-
SSDEEP
6144:i5tYTzqklVw910CIWrC9foCChVN6XCLWk6aMWgziMV1AXj16NYuLDuUcOibi5EB9:iUPTCBC9A/VIXCCkMWguMcj0vbd5E0/O
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
Signatures
-
Urelas
Urelas is a trojan targeting card games.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7Y18r(156).exe"C:\Users\Admin\AppData\Local\Temp\7Y18r(156).exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fesah.exe"C:\Users\Admin\AppData\Local\Temp\fesah.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zuwyt.exe"C:\Users\Admin\AppData\Local\Temp\zuwyt.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232B
MD5716833cbed19737c347390925805646a
SHA133c484ea81bf925b7e82584250c7b8c3e26f9fdc
SHA2563c6dfe17a6e2e31714c57b6d6e29df61765c70f6711e01eed296e05ea21bd839
SHA512dfcb304107a63525e294b0c9440eef0f1e21cc7e4f1108f5d0455906ee7f3364959b22c72e4c02de52909924cbd23715e12b3d78ac0ebbce88c07c2d0b1e6246
-
Filesize
338KB
MD5ab3f142f386eba9c7409f5f0f4dd3ee5
SHA1fe2bd12238bb919ebbe38e5afe27baa448de14c0
SHA256126a332e00e35112101064dc1711d374e023d9a1127eabb68025d158b73d8f4c
SHA512207b865d0d835e61e9cb976121cc8b2555e29c93ee41e72e2ab36ded7cdcea9a75f81a34cece0c881ce05fe6daa988132e56c148a7554bfcc4d80532ad2e32c7
-
Filesize
512B
MD5c5acb6df4a6de722df2fb7ef30cc1a47
SHA19b01866558504a109c4633dffd802fdaa1c444de
SHA2569bc6098c19f0321b2345951a9af80cc3bd72f129abaaa1ba7d0ada3354e00c19
SHA51234364d72fa5eb230378e242e2f021b6fad89cf1a1ea70b5ad345e29808a67fe067a9f70dcdc928824de22458cc7756eaae38dc8b53d35ad9e25ae19c0f675a4d
-
Filesize
226KB
MD5ab825a5daf4b4452a4b0d3e2ba680a5c
SHA1dc5f1f7f2c61e1f59a0a002917cb30374cfb357d
SHA256ebd51bdcf1b5178ab45f5ea997fee73ad4aef6fad2630d1a317bde3be0b8828f
SHA512f4f0032be08180f61bcb9ec86367e2d70a3d6b1c6dd5a5845d2408bcd99858336b5c872a9a0e9c2a865e6e88419da4c0f6f5dbc518e154c86dce98c655e4a8cb
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
540KB
-
Filesize
540KB