Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2024 01:14

General

  • Target

    84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe

  • Size

    84KB

  • MD5

    166c1187a42f846248992b70afb497be

  • SHA1

    cfbd1f3b3798a415139c4e336ce8ef9fa103237d

  • SHA256

    84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b

  • SHA512

    4565a554f0ef7a0c5ea3476d58ff95c6d4d547b18e0c9630cee0fb3ed658416718fb537cafd770eec4c48115e7f2df8541a55611d8bd2f77d39bf6d5d10e863b

  • SSDEEP

    1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURG:JznH976dUCnuniDS

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
    "C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1640
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    a01dba4c45102fc15292fd5591166536

    SHA1

    d96191c30e0f09439d8547f4ededbf6726ccd54b

    SHA256

    cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904

    SHA512

    277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    609ce0e460850082c0ebaa19e82c2597

    SHA1

    b6b475a8ff74cd1ac908cb70450f7bd52dbaa8ce

    SHA256

    b91838d7f251698e27bd43b0d199a998d2ca2f286befc70b50e23a0d8fee8e80

    SHA512

    d416bdb10800e56f971381fa843da964abfd0697dea7ec9801ad9b9e2bd9af4e6ad9e2ec6abae66174f142e606b791172b4d38379eec7c2d119052daaa6f8e12

  • \Users\Admin\AppData\Local\Temp\huter.exe

    Filesize

    84KB

    MD5

    f9458c431ad6b2b318fe5e9ce2392f42

    SHA1

    a01fc1b8defed0dbb091fe846f7c4cd1f00e5bd3

    SHA256

    7a5db11581422b4b57007dbc31c55f1f0f5b75bcbcc3cff22c0fce70aafefba8

    SHA512

    a0510be609e8ab9df627a6427b7e05892c0bbd5b9fc8f22b9e347e25e8cc2a5a2a07bf700b93261dfc4126f392fe4c60228d5de892b7aa4414340e096f04bf74

  • memory/1640-10-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1640-22-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1640-24-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1640-31-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/2860-0-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/2860-6-0x0000000002BE0000-0x0000000002C11000-memory.dmp

    Filesize

    196KB

  • memory/2860-19-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB