Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 01:47

General

  • Target

    df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe

  • Size

    79KB

  • MD5

    b39589f9343b509a07a49f759cb71630

  • SHA1

    918aecfca8251c09ed87ff918fe0b6e117be79f2

  • SHA256

    df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cd

  • SHA512

    f3e0548dba15a50394bfad22347df3909eb0ede869c732a722b6b8c64355b300baf482711f268c95b3ea2ccd0d8f4e2581356a8aa14ef162058e5d43beb75ba3

  • SSDEEP

    1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te5:4lnhYPlVMqmyAFIRRy

Score
10/10

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
    "C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    dd1155cbc9956e5dbeee97b18e3c4c5a

    SHA1

    e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

    SHA256

    53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

    SHA512

    1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

  • C:\Users\Admin\AppData\Local\Temp\huter.exe

    Filesize

    79KB

    MD5

    aefd2d81217ad053a1896d5a8f4af79d

    SHA1

    8e41a5e334a0ce07d5468cdafc7ff8061cbd9147

    SHA256

    62062c1a5b7195b3b0a570d60914df6306d2912333fc8fc20de74cf08b3c9fd8

    SHA512

    a6ecfb986e5aae58c4a94c7cfd59d37c2e58539a21b3b17ba8c233a868340f0214e6fab21f8b3e4d5cf577b294cbaa58a68f6335218dee4846b991d817167d29

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    d6b71bd88f9654567f0c65423b7d9a73

    SHA1

    9fff28cb119fba7d1b4402c354ec63083aff1270

    SHA256

    cb16e3fe444d1fbe4891907cdd33a5b46389478d101f9772f84ed6c35407dd95

    SHA512

    4082ba1d2eabecbccc618f08993bdd491fab02a7f58a268bd559002aa8114e8d303274f5cde2c3a8701244dbe8f59c4fff778b9df7fec21475c4ddd6726d87e1

  • memory/1972-10-0x0000000000770000-0x00000000007A0000-memory.dmp

    Filesize

    192KB

  • memory/1972-18-0x0000000000770000-0x00000000007A0000-memory.dmp

    Filesize

    192KB

  • memory/1972-20-0x0000000000770000-0x00000000007A0000-memory.dmp

    Filesize

    192KB

  • memory/1972-27-0x0000000000770000-0x00000000007A0000-memory.dmp

    Filesize

    192KB

  • memory/4344-0-0x00000000004D0000-0x0000000000500000-memory.dmp

    Filesize

    192KB

  • memory/4344-15-0x00000000004D0000-0x0000000000500000-memory.dmp

    Filesize

    192KB