Malware Analysis Report

2024-11-16 13:28

Sample ID 240811-ddgqba1hlr
Target d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687
SHA256 d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687
Tags
urelas discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687

Threat Level: Known bad

The file d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687 was found to be: Known bad.

Malicious Activity Summary

urelas discovery trojan

Urelas

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Deletes itself

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-11 02:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-11 02:53

Reported

2024-08-11 02:55

Platform

win7-20240708-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\biudfw.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\biudfw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe

"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "

Network

Country Destination Domain Proto
KR 218.54.47.76:11120 tcp
KR 218.54.47.74:11150 tcp
KR 218.54.47.76:11170 tcp
KR 218.54.47.77:11150 tcp

Files

memory/1716-0-0x0000000000F30000-0x0000000000F56000-memory.dmp

\Users\Admin\AppData\Local\Temp\biudfw.exe

MD5 ee3be7e15f8fb611eb87f3e21ea55266
SHA1 cc6924779f5d6bcc8fe35f6c223799b56d90d39a
SHA256 14c294ef46460620c4e793c98806deded21fa3f7f6158667d30b72b993df3b50
SHA512 76f8ae9b221428daf1690356774353de37dacb7a1fbc6b8184ef441de608f0331fcfeb86dc650c1c05778e39dd11ee7b227765f7fe5a656f19bcf43581a16d4f

memory/336-11-0x0000000000360000-0x0000000000386000-memory.dmp

memory/1716-10-0x0000000000950000-0x0000000000976000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

MD5 ee04d36e56bc1b6929e68a7909ebd670
SHA1 2776c54f264b5f2c41fdfe560d68c1141dbab43c
SHA256 a68cfe5d3eb663404c01a52acd5f281d11eadab22c18064db1dc889e39b92a29
SHA512 092b1d80e431c7cf574606d1a920f2a724a491ab812a6ce0477ed44a052162c7609b3d202de9157e123165a1d60d297b02814325c6225a1d2b2576aa32c2b3cd

memory/1716-19-0x0000000000F30000-0x0000000000F56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 7cdc8777d33db85bc19aefb64879a7f7
SHA1 f2d494d4dfe93a05eb58513935196e8578648adf
SHA256 9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336
SHA512 34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

memory/336-22-0x0000000000360000-0x0000000000386000-memory.dmp

memory/336-24-0x0000000000360000-0x0000000000386000-memory.dmp

memory/336-31-0x0000000000360000-0x0000000000386000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-11 02:53

Reported

2024-08-11 02:56

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\biudfw.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\biudfw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe

"C:\Users\Admin\AppData\Local\Temp\d64bbce1a2cb3974778830e35596b819286a79ec4c877faa0249fdaab8bcc687.exe"

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
KR 218.54.47.76:11120 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
KR 218.54.47.74:11150 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
KR 218.54.47.76:11170 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
KR 218.54.47.77:11150 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/1048-0-0x0000000000370000-0x0000000000396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

MD5 b379ae1e5ce3500467579b2ab147a787
SHA1 4157ef81397db01e75b196815a2c0c96c5497a29
SHA256 dcc251667638a4d98fddedc05c7fefaf849163595fe712d17e55112b3cc26a3b
SHA512 d2f2ad22a8bc3a28df94899e6a110ec533a16083cfd6f653588402872f0fe08de1c3b4964a3b76dbee4511c0d4f9fca0374975752704154be3ed2c2d1183e381

memory/3104-12-0x0000000000010000-0x0000000000036000-memory.dmp

memory/1048-14-0x0000000000370000-0x0000000000396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

MD5 ee04d36e56bc1b6929e68a7909ebd670
SHA1 2776c54f264b5f2c41fdfe560d68c1141dbab43c
SHA256 a68cfe5d3eb663404c01a52acd5f281d11eadab22c18064db1dc889e39b92a29
SHA512 092b1d80e431c7cf574606d1a920f2a724a491ab812a6ce0477ed44a052162c7609b3d202de9157e123165a1d60d297b02814325c6225a1d2b2576aa32c2b3cd

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 7cdc8777d33db85bc19aefb64879a7f7
SHA1 f2d494d4dfe93a05eb58513935196e8578648adf
SHA256 9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336
SHA512 34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

memory/3104-17-0x0000000000010000-0x0000000000036000-memory.dmp

memory/3104-19-0x0000000000010000-0x0000000000036000-memory.dmp

memory/3104-26-0x0000000000010000-0x0000000000036000-memory.dmp