Analysis Overview
SHA256
3077adf5453f5ee4cef15f22fadde4b4bb26b1c2322349abd03de40c468196b1
Threat Level: Known bad
The file 88bbd48e4bce90062a08802f98712770N.exe was found to be: Known bad.
Malicious Activity Summary
Urelas family
Urelas
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Deletes itself
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-13 10:52
Signatures
Urelas family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-13 10:52
Reported
2024-08-13 10:54
Platform
win7-20240704-en
Max time kernel
90s
Max time network
94s
Command Line
Signatures
Urelas
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe
"C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| KR | 218.54.47.76:11120 | tcp | |
| KR | 218.54.47.74:11150 | tcp | |
| KR | 218.54.47.76:11170 | tcp | |
| KR | 218.54.47.77:11150 | tcp |
Files
memory/1996-0-0x0000000000870000-0x0000000000898000-memory.dmp
\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | ecb919f131d9a6f1b0077789dd7112d6 |
| SHA1 | ccdfd88356336395078e91627cd66f817ef74fcc |
| SHA256 | ca6273a59feef38696c7415be8d625169ed3a749b2c6f843d7e84ff3165ce7db |
| SHA512 | 3615135a62159c1168fa369c892804b132ecc3286e7f26a81970fbeb609935824d7b5ad4364aa9031007d52d748d59d263f595517fc55efcb0671a259d1bb83c |
memory/1996-6-0x00000000004B0000-0x00000000004D8000-memory.dmp
memory/2484-10-0x0000000000EC0000-0x0000000000EE8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | da205e14a1e4d4db842b29fd7c551e81 |
| SHA1 | 8f3c706f4e6ddfe5524300e043e6f5b3e96ed7aa |
| SHA256 | 0f9b4f23e13001d731f0b7a5dcf413e9e71d1e06e70b5c7fdfca3eb19ca401cf |
| SHA512 | c5b0be41f4f90bc91018942d3652b4974f696c7eccc4c93ffc2a88640eaf5410e72b5aadd4b8b6a8de830191388b331e22a666348fe796b4641d160deb00dd33 |
memory/1996-18-0x0000000000870000-0x0000000000898000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | b4a86880004da8726288d7ec954885a8 |
| SHA1 | 1bab1cfbdc2c540246210bc7852f8fe7e8357b31 |
| SHA256 | c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46 |
| SHA512 | 22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4 |
memory/2484-21-0x0000000000EC0000-0x0000000000EE8000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-13 10:52
Reported
2024-08-13 10:54
Platform
win10v2004-20240802-en
Max time kernel
94s
Max time network
96s
Command Line
Signatures
Urelas
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\biudfw.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4980 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 4980 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 4980 wrote to memory of 4804 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Users\Admin\AppData\Local\Temp\biudfw.exe |
| PID 4980 wrote to memory of 3184 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 4980 wrote to memory of 3184 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 4980 wrote to memory of 3184 | N/A | C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe | C:\Windows\SysWOW64\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe
"C:\Users\Admin\AppData\Local\Temp\88bbd48e4bce90062a08802f98712770N.exe"
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| KR | 218.54.47.76:11120 | tcp | |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| KR | 218.54.47.74:11150 | tcp | |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| KR | 218.54.47.76:11170 | tcp | |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| KR | 218.54.47.77:11150 | tcp | |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
memory/4980-0-0x0000000000690000-0x00000000006B8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\biudfw.exe
| MD5 | 92ae7aa228ff84414ef166c064b904a4 |
| SHA1 | ab6de8f186cdfd9c58c3a0629efa6858ffdaa312 |
| SHA256 | e92b7a13dbe3cd833d03dcda2c2c9b64e23696f9050b32e0f10f5051b73b3bf3 |
| SHA512 | 74fe5335587a9f4f68f2564ae0316e19b270fc8eeb64286ba6618074d07ffb76a1c3d77ec70503e40244b9fd0f900e765b5d62aedcf2ad9b539ce73c74fe46cf |
memory/4804-10-0x0000000000770000-0x0000000000798000-memory.dmp
memory/4980-14-0x0000000000690000-0x00000000006B8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
| MD5 | da205e14a1e4d4db842b29fd7c551e81 |
| SHA1 | 8f3c706f4e6ddfe5524300e043e6f5b3e96ed7aa |
| SHA256 | 0f9b4f23e13001d731f0b7a5dcf413e9e71d1e06e70b5c7fdfca3eb19ca401cf |
| SHA512 | c5b0be41f4f90bc91018942d3652b4974f696c7eccc4c93ffc2a88640eaf5410e72b5aadd4b8b6a8de830191388b331e22a666348fe796b4641d160deb00dd33 |
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | b4a86880004da8726288d7ec954885a8 |
| SHA1 | 1bab1cfbdc2c540246210bc7852f8fe7e8357b31 |
| SHA256 | c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46 |
| SHA512 | 22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4 |
memory/4804-17-0x0000000000770000-0x0000000000798000-memory.dmp