Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-07-2024 19:15

General

  • Target

    1661221d219912683c3a62eae6603dda3714f8f602e895c1b2604bc1159d37be.exe

  • Size

    6.5MB

  • MD5

    905f253fda7bc0e45dc3441bc786635e

  • SHA1

    2271db4c633feb62df4d38c98949723cbfdd862f

  • SHA256

    1661221d219912683c3a62eae6603dda3714f8f602e895c1b2604bc1159d37be

  • SHA512

    59667bbc5acca0e25b201f014f93348d916306c13d8f6d060ec72d8aad0722913a46261358e953e1703a83c9fbad04c4e4e79b02adcf9ab2a16f3bc20acbc317

  • SSDEEP

    98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSe:i0LrA2kHKQHNk3og9unipQyOaOe

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1661221d219912683c3a62eae6603dda3714f8f602e895c1b2604bc1159d37be.exe
    "C:\Users\Admin\AppData\Local\Temp\1661221d219912683c3a62eae6603dda3714f8f602e895c1b2604bc1159d37be.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Users\Admin\AppData\Local\Temp\hovux.exe
      "C:\Users\Admin\AppData\Local\Temp\hovux.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\hopyso.exe
        "C:\Users\Admin\AppData\Local\Temp\hopyso.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Users\Admin\AppData\Local\Temp\mejyc.exe
          "C:\Users\Admin\AppData\Local\Temp\mejyc.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3296
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4656
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    340B

    MD5

    472a0a6217b7b2908675502fb682ab84

    SHA1

    64bb97f1d7a9cfe144c33c6c09de2f167e55c8f2

    SHA256

    f04c1f21953ca88cce113b66010f2032767301fe9438904e2991fe2b19ffa623

    SHA512

    36544d404f9db1e784ae0c09b2464c318c1f20230f80ad800ce105f9697dfa48ed7d88db92ab8157b6de59e00971cc2a0246683bef639f5741ea9c1c9c0d71f4

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    134d4e0b506c6134603c461f9d44628c

    SHA1

    d028bf37514bd9b7f0bef3af792e32a97b3c9679

    SHA256

    b934cf79abffa463ed4cbf29fc19440aa85862bbf76a695c42c89bdd2e5ebdaf

    SHA512

    72a28f67ded722817ef07970420a9e73b5146704563cc1c8ae1b9066cebee916b9bb6dd310dfb56962607824be597019a522f8f6fb09d672d39d702490ff85cf

  • C:\Users\Admin\AppData\Local\Temp\gbp.ini

    Filesize

    104B

    MD5

    dbef593bccc2049f860f718cd6fec321

    SHA1

    e7e9f8235b4eb70aa99dd2c38009f2152575a8d0

    SHA256

    30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a

    SHA512

    3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    49dad41dbcb86b87dd3335ea89e269da

    SHA1

    9e4b75c3ef820b63c15dabfd728c705cfc99fcdf

    SHA256

    19e2739c1dbd79efb3a5b4d5ae7d84590646b44fc7ece0ee72dd1e69da8f76c7

    SHA512

    310b86fd57c224e499e78cdf666bf3817474863bd804e0735904f9d2252a2ab18174710c41454cdb100a28e5b571b133815ade72d5f153537dc416b192a37a23

  • C:\Users\Admin\AppData\Local\Temp\hovux.exe

    Filesize

    6.5MB

    MD5

    90ce37df21b783806b4166df0f9c6b86

    SHA1

    6aa80fdc542f40f885d4fee7f1c569b5fd7fd0ea

    SHA256

    f0412bcbc2d3d9d0fe26a181911601c3f338de16f46bb46b83c326377c54ddd2

    SHA512

    3a255bdcc899907de8d416e0ed0cadd4a957466e57cbd4cde9569dc2c0292fe43ff1093694dd43f8287c7f21cf8e4a781663a01de8f485f05c6e811664f3a61c

  • C:\Users\Admin\AppData\Local\Temp\mejyc.exe

    Filesize

    459KB

    MD5

    25e621d03ee847160c9d045a2f63cd6f

    SHA1

    cc173fe01cc0500ca27a78a35b6e279cddbbc653

    SHA256

    ac855e556373c0da16340ffef9dd4c3355d534d9d27b3394be4e5b272e2f201c

    SHA512

    995cc28656a3a86450ae17038dc6a8b9fbd3bffc959ca9497926f6a4c83b6fa503dd4fa5cdd68bd7d629716eb3eebb5af4e5203e0dbc3b7c12a65e6b65518019

  • memory/2384-53-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/2384-58-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/2384-54-0x0000000002B60000-0x0000000002B61000-memory.dmp

    Filesize

    4KB

  • memory/2384-55-0x0000000002B70000-0x0000000002B71000-memory.dmp

    Filesize

    4KB

  • memory/2384-72-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/2384-56-0x0000000002B80000-0x0000000002B81000-memory.dmp

    Filesize

    4KB

  • memory/2384-52-0x0000000002B20000-0x0000000002B21000-memory.dmp

    Filesize

    4KB

  • memory/2384-51-0x0000000002B10000-0x0000000002B11000-memory.dmp

    Filesize

    4KB

  • memory/2384-50-0x0000000002B00000-0x0000000002B01000-memory.dmp

    Filesize

    4KB

  • memory/3296-71-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB

  • memory/3296-75-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB

  • memory/4656-39-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/4656-25-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/4656-32-0x0000000002C70000-0x0000000002C71000-memory.dmp

    Filesize

    4KB

  • memory/4656-33-0x0000000002C80000-0x0000000002C81000-memory.dmp

    Filesize

    4KB

  • memory/4656-36-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/4656-31-0x0000000002C30000-0x0000000002C31000-memory.dmp

    Filesize

    4KB

  • memory/4656-30-0x0000000001180000-0x0000000001181000-memory.dmp

    Filesize

    4KB

  • memory/4656-29-0x0000000001170000-0x0000000001171000-memory.dmp

    Filesize

    4KB

  • memory/4656-28-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

    Filesize

    4KB

  • memory/4656-41-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/4656-49-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/4656-34-0x0000000002C90000-0x0000000002C91000-memory.dmp

    Filesize

    4KB

  • memory/5060-4-0x0000000002C90000-0x0000000002C91000-memory.dmp

    Filesize

    4KB

  • memory/5060-0-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/5060-26-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/5060-14-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/5060-1-0x0000000000F40000-0x0000000000F41000-memory.dmp

    Filesize

    4KB

  • memory/5060-2-0x0000000000F50000-0x0000000000F51000-memory.dmp

    Filesize

    4KB

  • memory/5060-27-0x0000000000526000-0x000000000087A000-memory.dmp

    Filesize

    3.3MB

  • memory/5060-5-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

    Filesize

    4KB

  • memory/5060-6-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

    Filesize

    4KB

  • memory/5060-13-0x0000000000400000-0x0000000000EEC000-memory.dmp

    Filesize

    10.9MB

  • memory/5060-7-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

    Filesize

    4KB

  • memory/5060-9-0x0000000000526000-0x000000000087A000-memory.dmp

    Filesize

    3.3MB

  • memory/5060-3-0x0000000001140000-0x0000000001141000-memory.dmp

    Filesize

    4KB