Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 11:16

General

  • Target

    92ea1c4a69e8b1f2708691e8a6160e78f74c224d7a498f7f3cecb93a745ce080N.exe

  • Size

    57KB

  • MD5

    bdfd38c1c9211eb0999080aa68619850

  • SHA1

    bb380f9dd7f4f0f67f25e98deb38ea42ae16a939

  • SHA256

    92ea1c4a69e8b1f2708691e8a6160e78f74c224d7a498f7f3cecb93a745ce080

  • SHA512

    99e7e7bf831eecc9127333659747786f8723c03223af2849769837323f78da92277de2d9370b0a80e08b7232069f8ff4dea9d63475f04df7e81525b3639e656e

  • SSDEEP

    1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1f:amZ+luXwy2f9LDhDf

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92ea1c4a69e8b1f2708691e8a6160e78f74c224d7a498f7f3cecb93a745ce080N.exe
    "C:\Users\Admin\AppData\Local\Temp\92ea1c4a69e8b1f2708691e8a6160e78f74c224d7a498f7f3cecb93a745ce080N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2808
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    57KB

    MD5

    7c6144f4c7e5f14a63d2f22e8507f89e

    SHA1

    051b89af99403d21c6d95346a319d7e27008bf25

    SHA256

    06b0d38f8c9014ef5a353ba0d8e06dcfc2ced9e6cb9a590d73ecb5f7df6f8986

    SHA512

    0fc24ef326947d3573b4521d35815ad365c3c22a8d6cff26d25a9f3248405777367063e3c4a9c7fd670a12f29b4c0ffc22cb7e44f972c1d9645df85c42dda58d

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    26625b4ca7658f7ba4dc7d982782323c

    SHA1

    574aa314998c39e683675ccf457b0305341a4aaf

    SHA256

    c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283

    SHA512

    5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    676482554c49f761e4f44639b6e96633

    SHA1

    4a2ec30252639ab31b09694f49df2b01def0a56c

    SHA256

    be4fdbd3339f0c3f757adb6ffacee9d92a378abbfb9251a1d06ec0dbf3aa200f

    SHA512

    034bed4cc8767d8100cd5c32d63f59b4c7dd4020c58d75600e4e0dd0fd8d4267a6c29e17a6c55357473784c499e92448bf4f0d40a80c7929f62b6e26b412b4e4

  • memory/1888-0-0x0000000000D20000-0x0000000000D52000-memory.dmp

    Filesize

    200KB

  • memory/1888-18-0x0000000000D20000-0x0000000000D52000-memory.dmp

    Filesize

    200KB

  • memory/2808-15-0x0000000000CF0000-0x0000000000D22000-memory.dmp

    Filesize

    200KB

  • memory/2808-21-0x0000000000CF0000-0x0000000000D22000-memory.dmp

    Filesize

    200KB

  • memory/2808-23-0x0000000000CF0000-0x0000000000D22000-memory.dmp

    Filesize

    200KB

  • memory/2808-30-0x0000000000CF0000-0x0000000000D22000-memory.dmp

    Filesize

    200KB