Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-10-2024 05:35

General

  • Target

    1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe

  • Size

    787KB

  • MD5

    18a6984e652c1d34b1dd7b55311c3170

  • SHA1

    c4b9936a677b053c8fc0002d6940550be73c4429

  • SHA256

    1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fb

  • SHA512

    5064e0346f986c7409caa03c40c8665ffd6428a9342d2d29b5d0f8f47d7e5e293aabb83bc5226599356b33449ddd566b456ef44280d610db761b0ddcde02f32a

  • SSDEEP

    12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgM:d7dLBftJLW5YUWLrkJB0PJgM

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe
    "C:\Users\Admin\AppData\Local\Temp\1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\ulivd.exe
      "C:\Users\Admin\AppData\Local\Temp\ulivd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Users\Admin\AppData\Local\Temp\ejybsy.exe
        "C:\Users\Admin\AppData\Local\Temp\ejybsy.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Users\Admin\AppData\Local\Temp\xibyn.exe
          "C:\Users\Admin\AppData\Local\Temp\xibyn.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2868
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1484
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    342B

    MD5

    ddb2edd44c8d44abfb991002fe5ac5fe

    SHA1

    fbc860bbc9bdddbef3f61a01640fbaa092cf270d

    SHA256

    25c5bc5b3294ba67c4c27ba2d441644703e67263f0f9227e91cefd24e4ed42e0

    SHA512

    b28e88ec6dbdf7a7133f5f80db3ab25df0588e006a91c0794ffa36db32138be667a6e4e7c1274b3f987e1f0c4a13d371877b9c5bfc5ea284b74c8d8d0e3a5151

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    acf4781aea83478d31fadedae742c8a5

    SHA1

    aafb140829c092829e21dae165b1938f0cae6929

    SHA256

    55321fbe33216c1687ae756983afbdae782d01109ab2a2c553ea52adb544dea2

    SHA512

    6ec2920ae45deb28d9f5ae2fd70d1b3f0088f3398302e441df2e2ef2fd9889eba79617e627548ccc45080728ecb4385d1fc40c18d16eb9a88050e2ca5936e937

  • C:\Users\Admin\AppData\Local\Temp\gbp.ini

    Filesize

    104B

    MD5

    dbef593bccc2049f860f718cd6fec321

    SHA1

    e7e9f8235b4eb70aa99dd2c38009f2152575a8d0

    SHA256

    30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a

    SHA512

    3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    4f7e485eb3a526a5fc929dc4c2daba40

    SHA1

    3389a96f9cdabf278502d868460db9c98a465612

    SHA256

    12a59fc22caec1578f2d07e64f5bb70e66a37b86bab832c44ffa90058bf5ae65

    SHA512

    557a0fed9a86ba2f8f0706da0bc839dafa1f7a59a2ed6a653dcd434fc9c76f0a1287802365172758125c22962cc866ebfbeca4c05b527c38cbdae2cb07b4da39

  • C:\Users\Admin\AppData\Local\Temp\ulivd.exe

    Filesize

    787KB

    MD5

    0e5ebdecce3fcf71c5e2b661e1840d5f

    SHA1

    ba08fb754255461d7be72633df4b6d5e9d3baf11

    SHA256

    2e6e18618b09643ba4e55c40d64787075191c4414a0c25eae9418e13f8f1d7af

    SHA512

    31b37f4eac98fb8c3134ddb9adff2219e8476035b8be53a3ee90a75886b481be6cbb56b93c5f510b70b58f73e64e25a01d7dfdd1a4dd2e152c0b7c33a7c814a8

  • C:\Users\Admin\AppData\Local\Temp\xibyn.exe

    Filesize

    601KB

    MD5

    7b5fb7bf7f4432bda4ac14bcfa589154

    SHA1

    640523aeaff36b9181301193524e5dc3815d74a9

    SHA256

    a3513722861ef2a811cb22b78e4122331011765ba76862b56511b0d673b6b41d

    SHA512

    d695ab1f4832542a1b3ba7ed66044fd75b3fa0c8f66463750ff3da925a01f36f656052cf7e9218699e8643fe3255ef21891764b6b4664b9e9198db585b7c2d25

  • memory/2424-20-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2424-2-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2588-36-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2588-34-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2588-57-0x0000000003D40000-0x0000000003F62000-memory.dmp

    Filesize

    2.1MB

  • memory/2588-56-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2704-32-0x0000000003070000-0x000000000313B000-memory.dmp

    Filesize

    812KB

  • memory/2704-33-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2704-23-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2868-58-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/2868-61-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB