Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 10:44

General

  • Target

    b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe

  • Size

    331KB

  • MD5

    bf8ae2db32725e0025a55c1eddd84c70

  • SHA1

    1f7fa30f1207dfba715c0c1ddbb5a557e1753087

  • SHA256

    b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfc

  • SHA512

    9959eb75a59623d7bd9a9f9aa6b442244c94bd752a28cd6b3fa8dcddf9bbf7a4ff1296550f2e3df1b9d6ad8c2ff63d9b2c437d948b08064e3bc502df7c66393a

  • SSDEEP

    3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisO:Nd7rpL43btmQ58Z27zw39gY2FeZhmzZ

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe
    "C:\Users\Admin\AppData\Local\Temp\b8b08b9cd13255e894306d949b7f2cd6b73d95cbc855901987804b7829e8dcfcN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Local\Temp\byipt.exe
      "C:\Users\Admin\AppData\Local\Temp\byipt.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Users\Admin\AppData\Local\Temp\mefyro.exe
        "C:\Users\Admin\AppData\Local\Temp\mefyro.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Users\Admin\AppData\Local\Temp\mymij.exe
          "C:\Users\Admin\AppData\Local\Temp\mymij.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4236
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3348
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    342B

    MD5

    db530785ddab2262c4b5581640b46cb2

    SHA1

    663b49c33e19a146389ca6d2e693c0408d764954

    SHA256

    dc4caff8b354ad6a56b0a8f9198240022c7113f18187cc4fb502645c920c5827

    SHA512

    5eb24c783f8890eba38164aed7c54ac2affc27cd766a016e45baec1e10e5f4f6f5751d430ab1e3b3120d46d2245e53e8ddc951c0d0222624b7f1ef47c0229edd

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    430011d7369ed65c8fc59216e757c56b

    SHA1

    b75a4cae517a222b4b849d848c716f9b7a7e1e6e

    SHA256

    6ede09b00585a266d82a416ee3592aa9a8dfbc101ca768657cfd3fea574c4901

    SHA512

    91c6c99a41833cca170f85fc12e9cdb29630be89e7448ce50f614ae3077015d515e5c3d20623d85d87b41c4fbd3d5a5bea4996756a4c46b9d8aee0fdb5575d4b

  • C:\Users\Admin\AppData\Local\Temp\byipt.exe

    Filesize

    331KB

    MD5

    6f732454c643063f9ee619ab0061c01f

    SHA1

    2fbaa15064c15cff0e522445bc0822ad2508f5f3

    SHA256

    cf223a1fb37dcacdec47b2c42cb7bf640d34372cf7fc1262547e84640b35c432

    SHA512

    204f2c2f6bbc0bcfd398f5a70f97c69e68f4c591f534c54a0c1420256350d19cd45e1471a6d2dc2c768b139116c31eb934272c67be51442a6614946c12d3f95e

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    eaf71668f015a91f23c2ba9059644553

    SHA1

    4fdd7794ae9a58cab82a61543a92bdd722eea385

    SHA256

    45e60e9a7f9d29ecae3e0b5b9819e8571e5105ed05aacc6e4091610cf5e4950b

    SHA512

    4bc93c0764968a0fcb04b90ac04dc700d4149297f0a39b4d63cecf14525bf1e844adfe724bf2cedf66744ae4785158319fea609b4d3591c726b8946f1eb8555d

  • C:\Users\Admin\AppData\Local\Temp\mymij.exe

    Filesize

    136KB

    MD5

    4380b7f758d66ec62cac8792f64293aa

    SHA1

    4375170b2c2229b15a61bbe47bc70db8a64ac597

    SHA256

    ec727787f9e08de4b524b5393c69186988c6791e9a07ce493cdb8cecfdfadd03

    SHA512

    39753f609505b5d6e4e6ab535f417c28a90116392cc23a13fc743eaab9d1e03ac65d4f04935a465e00fdb91f67a2982939a9bee6bcaedacc2e28caf21ccd2d44

  • memory/2448-42-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2448-25-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2944-24-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/4236-41-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-40-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-39-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-37-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-44-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-45-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-46-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-47-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-48-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/4236-49-0x0000000000AD0000-0x0000000000B5C000-memory.dmp

    Filesize

    560KB

  • memory/5032-0-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/5032-14-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB