Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 15:04

General

  • Target

    267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe

  • Size

    57KB

  • MD5

    92777caee4500fd51c45f28309c86400

  • SHA1

    a14bddba1c53a0dc74200fe788f10b4d1f026c38

  • SHA256

    267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9

  • SHA512

    4e1b8dca0f91b04a1ea7825b83a7498134560af15454e3cc46bb14c16ddb613cfa53d5a2ad97acb68961479a0b914b4b0e53e9a939988654c9e3dc2b3c9e1f5a

  • SSDEEP

    1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1LgU:amZ+luXwy2f9LDhDLgU

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe
    "C:\Users\Admin\AppData\Local\Temp\267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    26625b4ca7658f7ba4dc7d982782323c

    SHA1

    574aa314998c39e683675ccf457b0305341a4aaf

    SHA256

    c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283

    SHA512

    5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    83216fa7c3a8fbc7b3d9ee51e34f1f01

    SHA1

    daaad735ac904d587a2f5a0ad5e1fb5d479429b7

    SHA256

    86195fc0bec550aa4abb97244154862f8bd3b970e678850305b12d2786b30f1b

    SHA512

    d11273f59ed60098b2ffae4945cf8766061f4913b0fc15ddf188d53de9f9b74348598fa4dd3e6aaebcf81f2cd3f53c4d61456b25e28ca341f11d8b2bd56d1493

  • \Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    57KB

    MD5

    067fcead33f4ff2f26304190154c8ebe

    SHA1

    6e68b628083931f8f304f9762b53836794cca80e

    SHA256

    a16c134f31227e995b2afc4144eafa9cdc5b1021123d14012b9bc789a5c7ede2

    SHA512

    32d254308d1bb07fb1ee3e6e6ec4ea832265e0b584d6c9788e2062af4ea8e592c3ab87248196958a23350c3da5503acbbf531c8f6162a70c0ccf8e20dd2c9159

  • memory/2060-19-0x0000000001310000-0x0000000001342000-memory.dmp

    Filesize

    200KB

  • memory/2060-22-0x0000000001310000-0x0000000001342000-memory.dmp

    Filesize

    200KB

  • memory/2060-25-0x0000000001310000-0x0000000001342000-memory.dmp

    Filesize

    200KB

  • memory/2060-31-0x0000000001310000-0x0000000001342000-memory.dmp

    Filesize

    200KB

  • memory/2520-0-0x0000000000D00000-0x0000000000D32000-memory.dmp

    Filesize

    200KB

  • memory/2520-16-0x00000000005D0000-0x0000000000602000-memory.dmp

    Filesize

    200KB

  • memory/2520-18-0x0000000000D00000-0x0000000000D32000-memory.dmp

    Filesize

    200KB