Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2024 03:49

General

  • Target

    d8007ce7bf001d9a9510c5dba9beca92db71d9890ae6f0598e0ca8303a7069e2.exe

  • Size

    332KB

  • MD5

    cfd3c189d1f86049e9a336e49c8d22e3

  • SHA1

    f6acb447f1fbc3b86970ad8e8432a02e47ad3308

  • SHA256

    d8007ce7bf001d9a9510c5dba9beca92db71d9890ae6f0598e0ca8303a7069e2

  • SHA512

    c450555fc0d22442361bd32c513ae9bef047709dd89b07394e82568a907182f8d522bb4c498b7eb1d642c2e823bc3799ccec3b2a3b60ca5f9f38c995ba50094b

  • SSDEEP

    6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYC:vHW138/iXWlK885rKlGSekcj66cif

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8007ce7bf001d9a9510c5dba9beca92db71d9890ae6f0598e0ca8303a7069e2.exe
    "C:\Users\Admin\AppData\Local\Temp\d8007ce7bf001d9a9510c5dba9beca92db71d9890ae6f0598e0ca8303a7069e2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\qiwea.exe
      "C:\Users\Admin\AppData\Local\Temp\qiwea.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Users\Admin\AppData\Local\Temp\suqow.exe
        "C:\Users\Admin\AppData\Local\Temp\suqow.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2780
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    340B

    MD5

    13fdc7532858d3efc012dd845602b5c0

    SHA1

    855cd250184f9f3e71c9358f6f1b11ce8aa6aa92

    SHA256

    fbafe6c113a34d13660efd70dd4133f1e53faed86b7dc7b460048b251a9efd14

    SHA512

    1e0e71d1a29e7f678e22933bd965d3eed362c0d91da0a81f91442ab60fd7fc20a4cfa8d781b7d2f3bf8dbee03d43afce9d52b61790dce65995941a435f5962dc

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    998721e81563622eb4490cef7e30dd61

    SHA1

    bc0588d7aa630d87dee0660376008b91d7af7397

    SHA256

    7049cb8a8fd0c9997b74e572888e8e3745d51f5cb0f3f832ebec515a364e22f5

    SHA512

    e18e187442a80990dc113467afd62fe1a6debe11e9659e1b173591bd9787ccdfee9d3ec2d93d3cfbb0deeb59b4ca90cc6f2fb8bbf6e73ca3da6308a92da1f2d2

  • C:\Users\Admin\AppData\Local\Temp\suqow.exe

    Filesize

    172KB

    MD5

    49dcaf947c914f6f517a068940e06407

    SHA1

    ba92efe517f178edb7d016be88165049062c6b4c

    SHA256

    b7cccf5e5e045b8a7a92c2880fb153ca8d5c934666691a065357ff661282f878

    SHA512

    2fb44e59ce1ae6b2a32e6a3be1c00d192ed0ecce6f6a29d7751d8fe6dbb52afa8c60077e1d106e015e1d069eed5193bfea69c5f1c7f8bfb3a796f2c7bf6ca163

  • \Users\Admin\AppData\Local\Temp\qiwea.exe

    Filesize

    332KB

    MD5

    0d78972dfe804ef333988f318834aa01

    SHA1

    4c24045a99fa3e8e1c25241b54c2bdf1b46de8ba

    SHA256

    7ba4580afeb30d9b611a304f07f85143325b0e4f39364e62b44863c7c8e95659

    SHA512

    b5055425d44cc70a095444d000dc37ea9064094060c2175288deb9d6d8b8e7192202cd94842108ffc4f6da2c460d69f40bd75fcb0d5357c3b793409ffea882d2

  • memory/548-0-0x0000000000930000-0x00000000009B1000-memory.dmp

    Filesize

    516KB

  • memory/548-7-0x00000000009C0000-0x0000000000A41000-memory.dmp

    Filesize

    516KB

  • memory/548-1-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/548-21-0x0000000000930000-0x00000000009B1000-memory.dmp

    Filesize

    516KB

  • memory/2040-11-0x0000000000FC0000-0x0000000001041000-memory.dmp

    Filesize

    516KB

  • memory/2040-24-0x0000000000FC0000-0x0000000001041000-memory.dmp

    Filesize

    516KB

  • memory/2040-12-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2040-40-0x0000000000FC0000-0x0000000001041000-memory.dmp

    Filesize

    516KB

  • memory/2780-41-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-42-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-46-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-47-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-48-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-49-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB

  • memory/2780-50-0x0000000000AE0000-0x0000000000B79000-memory.dmp

    Filesize

    612KB