Analysis Overview
SHA256
d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687
Threat Level: Known bad
The file d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687 was found to be: Known bad.
Malicious Activity Summary
Urelas
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Deletes itself
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-11 02:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-11 02:53
Reported
2024-08-11 02:55
Platform
win7-20240708-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Urelas
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe
"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| KR | 218.54.47.76:11120 | tcp | |
| KR | 218.54.47.74:11150 | tcp | |
| KR | 218.54.47.76:11170 | tcp | |
| KR | 218.54.47.77:11150 | tcp |
Files
memory/1716-0-0x0000000000F30000-0x0000000000F56000-memory.dmp
\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | ee3be7e15f8fb611eb87f3e21ea55266 |
| SHA1 | cc6924779f5d6bcc8fe35f6c223799b56d90d39a |
| SHA256 | 14c294ef46460620c4e793c98806deded21fa3f7f6158667d30b72b993df3b50 |
| SHA512 | 76f8ae9b221428daf1690356774353de37dacb7a1fbc6b8184ef441de608f0331fcfeb86dc650c1c05778e39dd11ee7b227765f7fe5a656f19bcf43581a16d4f |
memory/336-11-0x0000000000360000-0x0000000000386000-memory.dmp
memory/1716-10-0x0000000000950000-0x0000000000976000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | ee04d36e56bc1b6929e68a7909ebd670 |
| SHA1 | 2776c54f264b5f2c41fdfe560d68c1141dbab43c |
| SHA256 | a68cfe5d3eb663404c01a52acd5f281d11eadab22c18064db1dc889e39b92a29 |
| SHA512 | 092b1d80e431c7cf574606d1a920f2a724a491ab812a6ce0477ed44a052162c7609b3d202de9157e123165a1d60d297b02814325c6225a1d2b2576aa32c2b3cd |
memory/1716-19-0x0000000000F30000-0x0000000000F56000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | 7cdc8777d33db85bc19aefb64879a7f7 |
| SHA1 | f2d494d4dfe93a05eb58513935196e8578648adf |
| SHA256 | 9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336 |
| SHA512 | 34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f |
memory/336-22-0x0000000000360000-0x0000000000386000-memory.dmp
memory/336-24-0x0000000000360000-0x0000000000386000-memory.dmp
memory/336-31-0x0000000000360000-0x0000000000386000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-11 02:53
Reported
2024-08-11 02:56
Platform
win10v2004-20240802-en
Max time kernel
148s
Max time network
154s
Command Line
Signatures
Urelas
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe
"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| KR | 218.54.47.76:11120 | tcp | |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| KR | 218.54.47.74:11150 | tcp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| KR | 218.54.47.76:11170 | tcp | |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| KR | 218.54.47.77:11150 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
Files
memory/1048-0-0x0000000000370000-0x0000000000396000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | b379ae1e5ce3500467579b2ab147a787 |
| SHA1 | 4157ef81397db01e75b196815a2c0c96c5497a29 |
| SHA256 | dcc251667638a4d98fddedc05c7fefaf849163595fe712d17e55112b3cc26a3b |
| SHA512 | d2f2ad22a8bc3a28df94899e6a110ec533a16083cfd6f653588402872f0fe08de1c3b4964a3b76dbee4511c0d4f9fca0374975752704154be3ed2c2d1183e381 |
memory/3104-12-0x0000000000010000-0x0000000000036000-memory.dmp
memory/1048-14-0x0000000000370000-0x0000000000396000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | ee04d36e56bc1b6929e68a7909ebd670 |
| SHA1 | 2776c54f264b5f2c41fdfe560d68c1141dbab43c |
| SHA256 | a68cfe5d3eb663404c01a52acd5f281d11eadab22c18064db1dc889e39b92a29 |
| SHA512 | 092b1d80e431c7cf574606d1a920f2a724a491ab812a6ce0477ed44a052162c7609b3d202de9157e123165a1d60d297b02814325c6225a1d2b2576aa32c2b3cd |
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | 7cdc8777d33db85bc19aefb64879a7f7 |
| SHA1 | f2d494d4dfe93a05eb58513935196e8578648adf |
| SHA256 | 9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336 |
| SHA512 | 34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f |
memory/3104-17-0x0000000000010000-0x0000000000036000-memory.dmp
memory/3104-19-0x0000000000010000-0x0000000000036000-memory.dmp
memory/3104-26-0x0000000000010000-0x0000000000036000-memory.dmp