Analysis Overview
SHA256
1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1
Threat Level: Known bad
The file 1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1 was found to be: Known bad.
Malicious Activity Summary
Urelas family
Urelas
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
UPX packed file
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-13 19:27
Signatures
Urelas family
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-13 19:27
Reported
2024-10-13 19:29
Platform
win7-20241010-en
Max time kernel
150s
Max time network
84s
Command Line
Signatures
Urelas
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\qourn.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\rebou.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\qourn.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\qourn.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\rebou.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe
"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"
C:\Users\Admin\AppData\Local\Temp\qourn.exe
"C:\Users\Admin\AppData\Local\Temp\qourn.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
C:\Users\Admin\AppData\Local\Temp\rebou.exe
"C:\Users\Admin\AppData\Local\Temp\rebou.exe"
Network
| Country | Destination | Domain | Proto |
| KR | 218.54.31.226:11110 | tcp | |
| KR | 1.234.83.146:11170 | tcp | |
| KR | 218.54.31.165:11110 | tcp | |
| JP | 133.242.129.155:11110 | tcp |
Files
memory/2396-0-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\qourn.exe
| MD5 | a6177728943bd993459281a0c6b47369 |
| SHA1 | 56667b63c5b1c4e17fa52e0b40312fb0185049dd |
| SHA256 | b2e7a0d24427016eac02a116f7ffaa2c5ea0ef4c48df2782dfb99ee2429cd329 |
| SHA512 | 8b3a2baec3cdcd16072c5c8bb48cb69c689a49d995c69b45c57bede98854a2826bd486ef849b75693abaf2e6afe947423b03129176abb7263dd032ed306dfc63 |
memory/2164-9-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
| MD5 | 3fcf392798338eab201b4d578dd2a25a |
| SHA1 | 072c6577e302a2d1ced526ab3516a7d8bd8958e0 |
| SHA256 | 2f54ef30c389dd956a8b6bdd0599b570ad2ef9e8fbe50f7a6a1074a5aaab9ee3 |
| SHA512 | df6e7684e7f61739568d5863c1423b4a44f2ea8f74f055cdde46538cc04c701010419b76cbcfb6bbc0ff16c8816204861b7ad32051c35ccabd1c2975015b4992 |
memory/2396-17-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | 8d72c3d8e013466888f3ee9f18be05f5 |
| SHA1 | af5e8dce314146d508fdcf82653d65ed4f0d5793 |
| SHA256 | 9f779d4040e6afbaeb5f96d1ddb0fe61db86b8b7fea028727ae1d6f782aff906 |
| SHA512 | 69e198de6aa0528ff42047f65b0f342166cb15818c2b92cd77f334a3aecf55662c70e79b03e9add65d5e0dcbe30b093a82ce1bfbdaba2183a07e516d293c5b0c |
memory/2164-20-0x0000000000400000-0x00000000004B6000-memory.dmp
\Users\Admin\AppData\Local\Temp\rebou.exe
| MD5 | 28f06ee1e8c8d22d21ec460b5882e255 |
| SHA1 | 23dba0f9b8e53bfdd0ba08674f12ff19ec30f156 |
| SHA256 | 2ff5621ff819e440203b5c02ff0fc4f558f5e7ddd00f1f91aebbada443477db0 |
| SHA512 | 30aa45893623979eafb25e1f4508c5dcaeba6a3d3e0fcf3e40cfa404faa7692ae3e56daf89d62762cff832c38db1f6ba913fa457fa744d7bdce2bd70503b364f |
memory/2708-29-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2164-28-0x0000000000400000-0x00000000004B6000-memory.dmp
memory/2164-26-0x0000000003450000-0x00000000034E4000-memory.dmp
memory/2708-31-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2708-32-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2708-33-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2708-34-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2708-35-0x0000000000400000-0x0000000000494000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-13 19:27
Reported
2024-10-13 19:29
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Urelas
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\qokuu.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\qokuu.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cuubv.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cuubv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\qokuu.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe
"C:\Users\Admin\AppData\Local\Temp\1dc16907c189ac765c7d95fcd2695bae92ceb2690a1e35712bce3b302fa4cbe1.exe"
C:\Users\Admin\AppData\Local\Temp\qokuu.exe
"C:\Users\Admin\AppData\Local\Temp\qokuu.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
C:\Users\Admin\AppData\Local\Temp\cuubv.exe
"C:\Users\Admin\AppData\Local\Temp\cuubv.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.252.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| KR | 218.54.31.226:11110 | tcp | |
| KR | 1.234.83.146:11170 | tcp | |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.209.201.84.in-addr.arpa | udp |
| KR | 218.54.31.165:11110 | tcp | |
| US | 8.8.8.8:53 | 134.190.18.2.in-addr.arpa | udp |
| JP | 133.242.129.155:11110 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/1508-0-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\qokuu.exe
| MD5 | d02ef02f68cabe47cb36c175ef646f0d |
| SHA1 | e8ddfa28e4ceb01583845612c789ebf49b7065cf |
| SHA256 | 16147b1875bee72705b9487a0077016b801ee7b4c95e184d3cec93824b5db317 |
| SHA512 | c3357a6812fedff3a34844b096a4c6eccb4b8a47c762a5c51716ba5dec53b692f08cd27cb3f1366360c73e86c866689c674efd15931d638bda91dd8c677795e5 |
memory/3460-12-0x0000000000400000-0x00000000004B6000-memory.dmp
memory/1508-14-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
| MD5 | 3fcf392798338eab201b4d578dd2a25a |
| SHA1 | 072c6577e302a2d1ced526ab3516a7d8bd8958e0 |
| SHA256 | 2f54ef30c389dd956a8b6bdd0599b570ad2ef9e8fbe50f7a6a1074a5aaab9ee3 |
| SHA512 | df6e7684e7f61739568d5863c1423b4a44f2ea8f74f055cdde46538cc04c701010419b76cbcfb6bbc0ff16c8816204861b7ad32051c35ccabd1c2975015b4992 |
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
| MD5 | ba655ae17147c0abf71a1bea14c8ce95 |
| SHA1 | 41cad7e07dd3c3c4864ef3b53316a67826c9db7c |
| SHA256 | 1c089a13b32dac6cb58d82b44b26548f6186eceb8936e1697558dc2600969178 |
| SHA512 | e73eb5667cdc3c526df5baddcbe5b542e6128205eb8a8552e4dbdca42375d7809cf09033923e3137ab7525ce8697a14adcee9d5402a08973dd32a42f9afa13cc |
memory/3460-17-0x0000000000400000-0x00000000004B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cuubv.exe
| MD5 | 5e75eb789cc8e2482e77fd77258535ac |
| SHA1 | 91fdaa7b36e130acc623b805bcdd0a07c079c51b |
| SHA256 | f5de674ff792930f8a09945c805d1fcbf3f196cf2a7c39ef2bb72c8b0969e714 |
| SHA512 | 39ccb8b0b5fd8364c8c2634a43198630c8043b2d72564660a5494176b2ab7b6e627d51677baaeac79aad0fe1089b88ccc9646bd775813d749e64142d79c384ed |
memory/3528-27-0x00000000001D0000-0x00000000001D2000-memory.dmp
memory/3528-26-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3460-28-0x0000000000400000-0x00000000004B6000-memory.dmp
memory/3528-31-0x00000000001D0000-0x00000000001D2000-memory.dmp
memory/3528-30-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3528-32-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3528-33-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3528-34-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3528-35-0x0000000000400000-0x0000000000494000-memory.dmp