Analysis

  • max time kernel
    91s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 20:44

General

  • Target

    3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe

  • Size

    61KB

  • MD5

    1991fa7f68eb51bda59c016cc5736385

  • SHA1

    857090a6439901aeca151e45507eace8d00589b0

  • SHA256

    3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d

  • SHA512

    3d73f857024b2fb20e338c4fae0d0db4c7562e3a7a8bb36db066ccf85fb14fb322996cc13d373926ae6de2215c8dad0bf7e95c91d34d96e674deaba7f239b239

  • SSDEEP

    1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVz:Jo0cAthu6+FQ0JuPkz

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
    "C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2784
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    657ce9e5dd337971e44dfb9cb3fbf7dd

    SHA1

    026734083afaa4b7d298781b26a72ac9b67ac831

    SHA256

    3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

    SHA512

    79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    b2f167d976fbab4ebcad72be5625f596

    SHA1

    0a79af93d0857c93a01cfd402228775c49949abb

    SHA256

    a9465f51a25bf51cb3447e223c87bcc83f651554147eecc3f2436af2b2244c4c

    SHA512

    f62fa12998f5c82f99068b9d9e82977fa35a02ccdd4bfdc7c97015b2e5ccc63a3294f9eec1b8c7a74908d3451750d157c5a8c0631c0ffc5e0cccff358125dee6

  • \Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    61KB

    MD5

    438028d040bcf9ef5e90df0abb1af5b2

    SHA1

    87c967f65a922de4a960e31992bd5484b03ba0d4

    SHA256

    e091a36526d6f0f9bd7f66675d366ecf2983fb84614b673bf402d2e6f37be370

    SHA512

    740f986b7da06420856b12c8cf91586367cc1e38b01420a2ab6b7563cd7ad18d3876146cda1266c1ad923460293e4fbe6997dd90dc51a1c8168b2fa9dc9f00fc

  • memory/2784-10-0x0000000000C50000-0x0000000000C75000-memory.dmp

    Filesize

    148KB

  • memory/2784-22-0x0000000000C50000-0x0000000000C75000-memory.dmp

    Filesize

    148KB

  • memory/2784-24-0x0000000000C50000-0x0000000000C75000-memory.dmp

    Filesize

    148KB

  • memory/2784-31-0x0000000000C50000-0x0000000000C75000-memory.dmp

    Filesize

    148KB

  • memory/2860-0-0x0000000000130000-0x0000000000155000-memory.dmp

    Filesize

    148KB

  • memory/2860-9-0x0000000000200000-0x0000000000225000-memory.dmp

    Filesize

    148KB

  • memory/2860-19-0x0000000000130000-0x0000000000155000-memory.dmp

    Filesize

    148KB