Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 19:27

General

  • Target

    1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe

  • Size

    557KB

  • MD5

    875bb7d87500b1099b3d5f021fa7dc15

  • SHA1

    951fabd861860a304581316bb5df79dbb4994351

  • SHA256

    1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1

  • SHA512

    160df7ee8214c9f270b0f5a93bf6ba92f2ef5be55068c30e86c6af3f96981e22a34d25ca48ea8fa25ca12555168a2f58c6ef920610cbd8ea5c3770ffe842edfd

  • SSDEEP

    12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEy4:znPfQp9L3olqF4

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe
    "C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Users\Admin\AppData\Local\Temp\qokuu.exe
      "C:\Users\Admin\AppData\Local\Temp\qokuu.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Users\Admin\AppData\Local\Temp\cuubv.exe
        "C:\Users\Admin\AppData\Local\Temp\cuubv.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3528
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    340B

    MD5

    3fcf392798338eab201b4d578dd2a25a

    SHA1

    072c6577e302a2d1ced526ab3516a7d8bd8958e0

    SHA256

    2f54ef30c389dd956a8b6bdd0599b570ad2ef9e8fbe50f7a6a1074a5aaab9ee3

    SHA512

    df6e7684e7f61739568d5863c1423b4a44f2ea8f74f055cdde46538cc04c701010419b76cbcfb6bbc0ff16c8816204861b7ad32051c35ccabd1c2975015b4992

  • C:\Users\Admin\AppData\Local\Temp\cuubv.exe

    Filesize

    194KB

    MD5

    5e75eb789cc8e2482e77fd77258535ac

    SHA1

    91fdaa7b36e130acc623b805bcdd0a07c079c51b

    SHA256

    f5de674ff792930f8a09945c805d1fcbf3f196cf2a7c39ef2bb72c8b0969e714

    SHA512

    39ccb8b0b5fd8364c8c2634a43198630c8043b2d72564660a5494176b2ab7b6e627d51677baaeac79aad0fe1089b88ccc9646bd775813d749e64142d79c384ed

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    ba655ae17147c0abf71a1bea14c8ce95

    SHA1

    41cad7e07dd3c3c4864ef3b53316a67826c9db7c

    SHA256

    1c089a13b32dac6cb58d82b44b26548f6186eceb8936e1697558dc2600969178

    SHA512

    e73eb5667cdc3c526df5baddcbe5b542e6128205eb8a8552e4dbdca42375d7809cf09033923e3137ab7525ce8697a14adcee9d5402a08973dd32a42f9afa13cc

  • C:\Users\Admin\AppData\Local\Temp\qokuu.exe

    Filesize

    557KB

    MD5

    d02ef02f68cabe47cb36c175ef646f0d

    SHA1

    e8ddfa28e4ceb01583845612c789ebf49b7065cf

    SHA256

    16147b1875bee72705b9487a0077016b801ee7b4c95e184d3cec93824b5db317

    SHA512

    c3357a6812fedff3a34844b096a4c6eccb4b8a47c762a5c51716ba5dec53b692f08cd27cb3f1366360c73e86c866689c674efd15931d638bda91dd8c677795e5

  • memory/1508-14-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1508-0-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/3460-28-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/3460-12-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/3460-17-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/3528-27-0x00000000001D0000-0x00000000001D2000-memory.dmp

    Filesize

    8KB

  • memory/3528-26-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3528-31-0x00000000001D0000-0x00000000001D2000-memory.dmp

    Filesize

    8KB

  • memory/3528-30-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3528-32-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3528-33-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3528-34-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3528-35-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB