Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 00:48

General

  • Target

    972675b4d17b944c0d9867f305391ce49df458f60fc21e9e37d2b6b481edcce1.exe

  • Size

    348KB

  • MD5

    99f923fe659ab29eab7d0b6ce916a4ad

  • SHA1

    5f5335c397aba69ad7eeb3c7acf96d3a85379697

  • SHA256

    972675b4d17b944c0d9867f305391ce49df458f60fc21e9e37d2b6b481edcce1

  • SHA512

    976f934ed6c6946049d6b6e1a4e1a0f6750336538fc3257567ef6618ff2aa7a9c2638ac1eb723d6e682c115bd2fe74f904355f54eaf0b408374b9d848d78e76e

  • SSDEEP

    6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZe:A0G5obGGraOpUWlpZ

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\972675b4d17b944c0d9867f305391ce49df458f60fc21e9e37d2b6b481edcce1.exe
    "C:\Users\Admin\AppData\Local\Temp\972675b4d17b944c0d9867f305391ce49df458f60fc21e9e37d2b6b481edcce1.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\ovofl.exe
      "C:\Users\Admin\AppData\Local\Temp\ovofl.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\AppData\Local\Temp\lexuym.exe
        "C:\Users\Admin\AppData\Local\Temp\lexuym.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4712
        • C:\Users\Admin\AppData\Local\Temp\veguj.exe
          "C:\Users\Admin\AppData\Local\Temp\veguj.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:816
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2796
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    340B

    MD5

    40c0cecdb6095e9022f9b96cd55f10a3

    SHA1

    b5be5385481f9373aa7bcc2fed4e21d5c0cf79da

    SHA256

    a0cdb22e6cbadeaf877aba273d6fa7b5c5162fa0a8671207364ac7607ddf5d24

    SHA512

    759cba8c297f7a1e2b0f9e4467fe9f27236eb41ecb99cf37d90828e03d2462949f7280a8a2c36b2067af3a803a8b6986bedf9144602e7cfbbbaef4e5f5b41e73

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    8ebc735d89a847088117dc9afe7520f6

    SHA1

    e8a915304c7e92f71070666025adee72efb06977

    SHA256

    ad194d0f56b74f783d169a08bb75861ef5aabc190efc3b9e8ce13219da393eeb

    SHA512

    f3d504776495ced3f0e67b2a1efe2c4d104016f73aaa6b24ec67136206357b2e46381051a8875a8384b23ceeae8d2b0e4ac4b5c69186908b5d4eac158ef89c30

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    a5254c72e0444330ef741c3be17c6a86

    SHA1

    4bf91b592b1e4877d3e1c15f07a4b20b239eadae

    SHA256

    f960bbc15defa3c448f96588f708de3d4b970bb0c3fc5ca9ddea18a763835c7c

    SHA512

    ab6ac3f705a2189fb9e5c976a6b43336e36d788c74a9fe5801f986abfcfcdd9cb4205d1cca3e74d520ac0c7de33bde52f8dcbab7469363ed43265f93a7b89fb1

  • C:\Users\Admin\AppData\Local\Temp\ovofl.exe

    Filesize

    348KB

    MD5

    ac835dc370e67bfe6d7896b7d1772b53

    SHA1

    8ed7bb949143be3b36482916cf8cfaeee32572b5

    SHA256

    f2063a8870521aef3eb2c13a5cd13615292ac64532e44179f333d15daaec4a2b

    SHA512

    66871d8362015dc56bc9628b5d5d66acc393e2f0f6a166289a055a795bbc948c090dde57bac5535503154a888ca104584f2a967e8131eb7d80c50b2ae4cf9f45

  • C:\Users\Admin\AppData\Local\Temp\veguj.exe

    Filesize

    115KB

    MD5

    9d27b50a0db2a28a8ee253e15d4f3765

    SHA1

    8779848bd5850c22585a1dcf6625d450e621ff3e

    SHA256

    35b11e97f06e8d95070d28c85e7a5709e26c62add5a9699bdd9558de4a2b80ed

    SHA512

    993ac62e6bcefd8afa4b4927f1501a8f326c2bcc1062def8c11ec9ffef14d0924add8f228549133968936932613d54add81dcfd490d1839d3b20cf5eca343857

  • memory/816-37-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-41-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-42-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-43-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-44-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-45-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/816-46-0x0000000000510000-0x0000000000592000-memory.dmp

    Filesize

    520KB

  • memory/1728-24-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2764-0-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2764-14-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/4712-25-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/4712-39-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB