Analysis
-
max time kernel
98s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 04:31
Behavioral task
behavioral1
Sample
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe
Resource
win7-20240903-en
General
-
Target
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe
-
Size
272KB
-
MD5
ac8bf2e5d6913198ca725bcadd2850b0
-
SHA1
85e654d8996ff42801f7236d9a9491cc511898ba
-
SHA256
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aa
-
SHA512
2b2874be2bc2250d7978a583e458066d78aff12d1162ecad998852a8f3c4352e0406f3fac730e275a141c7593dbac802ec6e271e6e7b6fc6ddb37f6d34513e7a
-
SSDEEP
3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0e:pOzRWu27dlOd5W0r
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid Process 4696 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exebiudfw.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exedescription pid Process procid_target PID 2028 wrote to memory of 4696 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 87 PID 2028 wrote to memory of 4696 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 87 PID 2028 wrote to memory of 4696 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 87 PID 2028 wrote to memory of 2968 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 88 PID 2028 wrote to memory of 2968 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 88 PID 2028 wrote to memory of 2968 2028 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe"C:\Users\Admin\AppData\Local\Temp\82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD5a0e8f6519186c5191a6b95cf79867362
SHA1f38d32dbce46174cc6612964c0bd1189e12ae9e6
SHA2560a7d915a7074bf1fe9cbb4eb7aa88139bfb87f4641cfae36a417a19bf2aa677b
SHA5123296726beffa38d82738315345e1727d26dd0da5855dc344fe6639cc5ed567a0218d711ceadd1fba6155113541e7dd43aeb3e30b168be0180e88826e33f9e9cb
-
Filesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
Filesize
340B
MD59411a7e5b4e13d2663f59583cdf06c3a
SHA16e556e2b41d17e1ceab0d7d5189c5d5b5223e365
SHA256c918d267437f73d3dba5d374e39a0c944d6bb7a8de7788578252bf75367506c1
SHA51243616f452682ee7148fef9ace69ca2d71d2236d5697ef83c1cd19c413295383740bc2104d5037f7dab0f83d403a4869ea878f03da875ef24ed6994fa5f222590