Analysis

  • max time kernel
    118s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 05:35

General

  • Target

    1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe

  • Size

    787KB

  • MD5

    18a6984e652c1d34b1dd7b55311c3170

  • SHA1

    c4b9936a677b053c8fc0002d6940550be73c4429

  • SHA256

    1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fb

  • SHA512

    5064e0346f986c7409caa03c40c8665ffd6428a9342d2d29b5d0f8f47d7e5e293aabb83bc5226599356b33449ddd566b456ef44280d610db761b0ddcde02f32a

  • SSDEEP

    12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgM:d7dLBftJLW5YUWLrkJB0PJgM

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe
    "C:\Users\Admin\AppData\Local\Temp\1023ba75c7c566c95b2dec666c915e3c18d7021e221e7a2dac3079250d0864fbN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\zewup.exe
      "C:\Users\Admin\AppData\Local\Temp\zewup.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Users\Admin\AppData\Local\Temp\ovqegu.exe
        "C:\Users\Admin\AppData\Local\Temp\ovqegu.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Users\Admin\AppData\Local\Temp\vexoe.exe
          "C:\Users\Admin\AppData\Local\Temp\vexoe.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4800
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2616
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    342B

    MD5

    ddb2edd44c8d44abfb991002fe5ac5fe

    SHA1

    fbc860bbc9bdddbef3f61a01640fbaa092cf270d

    SHA256

    25c5bc5b3294ba67c4c27ba2d441644703e67263f0f9227e91cefd24e4ed42e0

    SHA512

    b28e88ec6dbdf7a7133f5f80db3ab25df0588e006a91c0794ffa36db32138be667a6e4e7c1274b3f987e1f0c4a13d371877b9c5bfc5ea284b74c8d8d0e3a5151

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    e9c5a40e11bf1236a6ea4f5039bfe690

    SHA1

    c3a96906562922c0915f27d0f7e0e169c4f53485

    SHA256

    68cc0fbf95f86b7dd07827f3cad030fd76732b3ec68d14ae832c041238852d4d

    SHA512

    c8c2f2b9ac8c9e9efbd73809f56a6f5c12f8aab13e50ef9784220616623df6b48767704af304fb6a56e0de9b8c880f5eca5beec3ab0dc4da28606996e4ad9185

  • C:\Users\Admin\AppData\Local\Temp\gbp.ini

    Filesize

    104B

    MD5

    dbef593bccc2049f860f718cd6fec321

    SHA1

    e7e9f8235b4eb70aa99dd2c38009f2152575a8d0

    SHA256

    30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a

    SHA512

    3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    dd05ca74f2a91a37ab5333be43307556

    SHA1

    86cbb23ff4e13050eb640c1d5c83f344c1c04a93

    SHA256

    bd9c529232f392fdbbfa328b732c473e1d27456299d55c1d08ccae5971556629

    SHA512

    b37ee8343791145b3c3e3160fda26fba5e35c67454fa3cd92a059e15c2321303adab94b9ec7453921b67552a985754532507d4d1dadcc6e9a0691d1fde2a4ec1

  • C:\Users\Admin\AppData\Local\Temp\vexoe.exe

    Filesize

    601KB

    MD5

    e40791d8a688b84d0d4fcaee0526cebf

    SHA1

    69348622eda724acd94f1bc07eb8a854adbc4a87

    SHA256

    31dd9a78b360275e435acd53b73d6c8595187e52e595b97f19d0bf6af1be417e

    SHA512

    a7b6d75b008511fefbfbc2fa942daca0e64db51cb4c144131e8dd2c0042671b5874bc5423ff94337295ddc5bb96bd0d3ce435b4b8acd7387052a0f63a0ac3b50

  • C:\Users\Admin\AppData\Local\Temp\zewup.exe

    Filesize

    787KB

    MD5

    d59b6f8b64079407e87c7ed868e1c8b4

    SHA1

    b648bcca9aab2cf0662af9c37a8f0f0b0ba471c6

    SHA256

    93b7c231264a83113db87753f444822e5fdfff4de39eab959ad54c9d6414a9a2

    SHA512

    edc161c2aaf947ac62c97b63b37daded1a930d6f9631dbfc762d7402c8f244f5b0af744217428e54065e34571610af5fdb8c61b1cd9d8176e247520f58a40ec7

  • memory/700-14-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/700-26-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/3232-24-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/3232-27-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/3232-41-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/4800-39-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/4800-44-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/5080-0-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/5080-15-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB