Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 05:15

General

  • Target

    42f1a42c51329e2b5eec05e5d5136ea4f9dc1c898d92e7d9b72bb2b398e6ef49N.exe

  • Size

    507KB

  • MD5

    d7a09fa1022c2158e05302d1b8baae90

  • SHA1

    21cf03e4a631efec5eb307b884d8de22858b0d22

  • SHA256

    42f1a42c51329e2b5eec05e5d5136ea4f9dc1c898d92e7d9b72bb2b398e6ef49

  • SHA512

    617b478d5a63272d272754a78b85089339e47603813299875e8872558232c0caf954347fc72564d9e27a95d333d7c1721d28ced1b8cdbef01b6366e51ebf1f5a

  • SSDEEP

    12288:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKo4:3MUv2LAv9AQ1p4dKx

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f1a42c51329e2b5eec05e5d5136ea4f9dc1c898d92e7d9b72bb2b398e6ef49N.exe
    "C:\Users\Admin\AppData\Local\Temp\42f1a42c51329e2b5eec05e5d5136ea4f9dc1c898d92e7d9b72bb2b398e6ef49N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\sacya.exe
      "C:\Users\Admin\AppData\Local\Temp\sacya.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Users\Admin\AppData\Local\Temp\tokur.exe
        "C:\Users\Admin\AppData\Local\Temp\tokur.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1040
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    342B

    MD5

    130d92eaa9d32bcef99a054df40b4433

    SHA1

    4dafd76248f909e1529854f17d8949454502f2a7

    SHA256

    37d3dd052dc0165b2bbf944179407d4288d6116990ed20201816ddabb7daa579

    SHA512

    15fbf2cface17eaf09d2b7b35d9308bf974296bd761aa1008623174222e5caf2c86bae3495a9b968d26c6c9a364acb60b3df5153a46fd4ba648d3d7c4f06b9fa

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    25467732c72f33e143df206864ac2161

    SHA1

    a2464b36df9ba8f5ce3a7c8e9c7212a0d023267a

    SHA256

    666279b0bcdada79551effcbf5266a7bec4d7f674defcf24d68b10a250f320df

    SHA512

    4337d776138e05d35eac45b42e0e89f3afaf107a4ec554cdd0a2f8cc46c7747167e8d150c8a18a8ce368148816bdac21b3365e1184815033aa811ac30197e498

  • C:\Users\Admin\AppData\Local\Temp\sacya.exe

    Filesize

    507KB

    MD5

    d17fe14b083357ca12e750f799e0b329

    SHA1

    f3de432d9ec2ef5043c3603d588c1e4f9f60d350

    SHA256

    49b02d9946698c8dde1d17201227669e3af2adaee350f761e971922fc65c1449

    SHA512

    348c4bc67f58afdaee0fba0d5a87b69855931082c0c015284dfae17b68fed5d840566da2f804ec2683ba24dbce55b9c753b7297cc0ece09ca73830fc6093c7c6

  • C:\Users\Admin\AppData\Local\Temp\tokur.exe

    Filesize

    172KB

    MD5

    377d84de4be1f811d454271b6c81afb0

    SHA1

    8f07a26c12d8fbc1714d119a3a8b647433b86d40

    SHA256

    0e86b712170338e3fca626e186e3f78602ec38c2f0785cbe8a631ccc8fa6312f

    SHA512

    59e3f7b2badd4706424cfb8159b20bd2f82c73112894cbf562da6a9b9c92a2b08fe3503cb3f48dc07d5d86a8c48168faa9cec6377c3717fa01157be6e242ab88

  • memory/1040-28-0x0000000000820000-0x00000000008B9000-memory.dmp

    Filesize

    612KB

  • memory/1040-35-0x0000000000820000-0x00000000008B9000-memory.dmp

    Filesize

    612KB

  • memory/1040-33-0x0000000000820000-0x00000000008B9000-memory.dmp

    Filesize

    612KB

  • memory/1040-34-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/1040-27-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/1040-26-0x0000000000820000-0x00000000008B9000-memory.dmp

    Filesize

    612KB

  • memory/2800-14-0x00000000005F0000-0x0000000000671000-memory.dmp

    Filesize

    516KB

  • memory/2800-0-0x00000000005F0000-0x0000000000671000-memory.dmp

    Filesize

    516KB

  • memory/4008-31-0x0000000000620000-0x00000000006A1000-memory.dmp

    Filesize

    516KB

  • memory/4008-17-0x0000000000620000-0x00000000006A1000-memory.dmp

    Filesize

    516KB

  • memory/4008-12-0x0000000000620000-0x00000000006A1000-memory.dmp

    Filesize

    516KB