Analysis Overview
SHA256
168fb7063c7124b99bc523aa831fc3bccc5f64f3b3699911157b258bc883c834
Threat Level: Known bad
The file 6c444d97906346930901ba6270b704a0N.exe was found to be: Known bad.
Malicious Activity Summary
Urelas
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Deletes itself
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-28 07:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-28 07:27
Reported
2024-07-28 07:34
Platform
win10v2004-20240709-en
Max time kernel
108s
Max time network
125s
Command Line
Signatures
Urelas
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1072 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 1072 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 1072 wrote to memory of 4196 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 1072 wrote to memory of 4036 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 1072 wrote to memory of 4036 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 1072 wrote to memory of 4036 | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | C:\Windows\SysWOW64\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe
"C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| KR | 218.54.47.76:11120 | tcp | |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| KR | 218.54.47.74:11150 | tcp | |
| KR | 218.54.47.76:11170 | tcp | |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| KR | 218.54.47.77:11150 | tcp | |
| NL | 52.111.243.29:443 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
Files
memory/1072-0-0x0000000000580000-0x00000000005A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | 95d700a5a67ebbd78b5d280b574661ee |
| SHA1 | f947b96343538dba0371e09e8eff1f22914ff800 |
| SHA256 | 50b642b5b37f9f6f49358111350dd616634e813d8643d3efc971b202cb385712 |
| SHA512 | d01b9c28cc31de1c7cf3e6896f4e8439cee3b6a67e43f5f5eef232da58f41875499c6e7e27314265431407e1836acc71c81013b816cfc51f5056ceae2e2ae3c7 |
memory/4196-9-0x00000000005A0000-0x00000000005C6000-memory.dmp
memory/1072-14-0x0000000000580000-0x00000000005A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | ac92f394868bdc5b84692156171d2d6e |
| SHA1 | 2fb1837134d6faa8ffd63b3ff79725dea187c5a0 |
| SHA256 | d572f192902d38f9d318306a2beb77f9fa7c79aef5010dd17152323ce80d8850 |
| SHA512 | e85a8ca9dcd8810ce1d99978499a0be7edb10f8ef56b2e33c8c80d733098659ede0f4d912a1843567a8333becdf8cc2d39dc0711c69b4783d0db80e983d9c520 |
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | b4a86880004da8726288d7ec954885a8 |
| SHA1 | 1bab1cfbdc2c540246210bc7852f8fe7e8357b31 |
| SHA256 | c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46 |
| SHA512 | 22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4 |
memory/4196-17-0x00000000005A0000-0x00000000005C6000-memory.dmp
memory/4196-19-0x00000000005A0000-0x00000000005C6000-memory.dmp
memory/4196-25-0x00000000005A0000-0x00000000005C6000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-28 07:27
Reported
2024-07-28 07:34
Platform
win7-20240704-en
Max time kernel
119s
Max time network
126s
Command Line
Signatures
Urelas
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe
"C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| KR | 218.54.47.76:11120 | tcp | |
| KR | 218.54.47.74:11150 | tcp | |
| KR | 218.54.47.76:11170 | tcp | |
| KR | 218.54.47.77:11150 | tcp |
Files
memory/588-0-0x00000000009E0000-0x0000000000A06000-memory.dmp
\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | f7af77b1b1f047739ca3322ef8352b5d |
| SHA1 | 210956685ef7045c21400c7c938e4911d3ac1f0f |
| SHA256 | 56e726e5c77d9a751829b80e1e6673795aba77610f3bc951c83aa4493169902f |
| SHA512 | 6d3471221cf7cfd5a8d41b52360cfc96a3a44b123ed5fd40a536f7d873c7e816ca6f68d338a459e0422466bc422bc9d9ee40b864727cc5211c299b23b79b6ab3 |
memory/2804-10-0x0000000001380000-0x00000000013A6000-memory.dmp
memory/588-9-0x0000000000480000-0x00000000004A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | ac92f394868bdc5b84692156171d2d6e |
| SHA1 | 2fb1837134d6faa8ffd63b3ff79725dea187c5a0 |
| SHA256 | d572f192902d38f9d318306a2beb77f9fa7c79aef5010dd17152323ce80d8850 |
| SHA512 | e85a8ca9dcd8810ce1d99978499a0be7edb10f8ef56b2e33c8c80d733098659ede0f4d912a1843567a8333becdf8cc2d39dc0711c69b4783d0db80e983d9c520 |
memory/588-18-0x00000000009E0000-0x0000000000A06000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | b4a86880004da8726288d7ec954885a8 |
| SHA1 | 1bab1cfbdc2c540246210bc7852f8fe7e8357b31 |
| SHA256 | c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46 |
| SHA512 | 22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4 |
memory/2804-21-0x0000000001380000-0x00000000013A6000-memory.dmp
memory/2804-23-0x0000000001380000-0x00000000013A6000-memory.dmp
memory/2804-29-0x0000000001380000-0x00000000013A6000-memory.dmp