Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 23:41

General

  • Target

    74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe

  • Size

    333KB

  • MD5

    ea82ce3469ef3de8551168d21890befa

  • SHA1

    70ebc82509ed3ce57dc9a9b12c0928e077c941c7

  • SHA256

    74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc

  • SHA512

    dd3b31ea1506a50f684cd2d178811bb0b3c86f8e53911828c21f61785e3a772b14d7b9c975ba852c7c44d86f8420fe86b5abaa0206184db80d35b69bbeaa77b6

  • SSDEEP

    6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYA:vHW138/iXWlK885rKlGSekcj66cil

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe
    "C:\Users\Admin\AppData\Local\Temp\74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Temp\tepij.exe
      "C:\Users\Admin\AppData\Local\Temp\tepij.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\apkig.exe
        "C:\Users\Admin\AppData\Local\Temp\apkig.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3140
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    340B

    MD5

    8390ca40cfaeae8d2a95426f9259689d

    SHA1

    cf91725781c4ae7dbcc0a445e7031f2a15d8ee74

    SHA256

    3a70f7f2a0cd7aecd1b3a0848c781619189eb152bd014e0146777b28f4692478

    SHA512

    041bf25674b43df57e8c66410020622b2b8ff5cfe15005e43f0df66fb9e77a1ad0e39d8a59a38b8178cd3251fc471b2bcc0146742fab3d838ee951f299b07a22

  • C:\Users\Admin\AppData\Local\Temp\apkig.exe

    Filesize

    172KB

    MD5

    ce0b8bda6ce405537381069c3109f808

    SHA1

    0cc978488667cee7280031b8cef986f3e8d1b56c

    SHA256

    bb8667475a1d5512f00a5fc2fc71e44af49d5d9997df02aa4f6488b260e51b93

    SHA512

    e0676e80e49f884c261d5aeb040cc56c5389993af20d8741b7791ef9b79674765199f2d8d7dfdb292173b143ece982bc31e0a0b34018ea0ddf7957c8cf5e58d5

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    f02b734d4f9fd7ac00717cbb5ce2e7e3

    SHA1

    31d7b5fb096ac00c1a8a788d6f02054c047135bc

    SHA256

    a185f1c35c7b678c36cc9d79b56a0417c861b095603ed3b44328f515c8100fd7

    SHA512

    1e5a445384d49d9e25892d27bf255a584b22ee563d8a5f836e551e18e2ecdc6f1c74487bf335c9862ffa59492d586055bad0559c5ca0b4f6428e33f4b9c65e7b

  • C:\Users\Admin\AppData\Local\Temp\tepij.exe

    Filesize

    333KB

    MD5

    55c25404dff7dac00f6e172a893a5242

    SHA1

    bdbecd316627bba2ed4b513bb1f109d616e65486

    SHA256

    7ba899a1740d06ffacb8a328568172f691d23e90dbe850298a9a081cb42fb5ab

    SHA512

    2688c5cb0d1c48ab65083d33e5d62e8327c596ddd973ee5da7a711167b5ec3a30d5c32a466bd5518f529af5a1cf13e207995bc83ba8d56a5fea4c321db2779cd

  • memory/2648-21-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/2648-44-0x0000000000520000-0x00000000005A1000-memory.dmp

    Filesize

    516KB

  • memory/2648-13-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/2648-12-0x0000000000520000-0x00000000005A1000-memory.dmp

    Filesize

    516KB

  • memory/2648-20-0x0000000000520000-0x00000000005A1000-memory.dmp

    Filesize

    516KB

  • memory/3140-46-0x0000000000D70000-0x0000000000D72000-memory.dmp

    Filesize

    8KB

  • memory/3140-39-0x0000000000D70000-0x0000000000D72000-memory.dmp

    Filesize

    8KB

  • memory/3140-40-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-38-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-47-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-48-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-49-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-50-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/3140-51-0x0000000000CD0000-0x0000000000D69000-memory.dmp

    Filesize

    612KB

  • memory/5020-17-0x0000000000460000-0x00000000004E1000-memory.dmp

    Filesize

    516KB

  • memory/5020-1-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

    Filesize

    4KB

  • memory/5020-0-0x0000000000460000-0x00000000004E1000-memory.dmp

    Filesize

    516KB