Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/10/2024, 15:04
Static task
static1
Behavioral task
behavioral1
Sample
267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe
Resource
win7-20240903-en
General
-
Target
267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe
-
Size
57KB
-
MD5
92777caee4500fd51c45f28309c86400
-
SHA1
a14bddba1c53a0dc74200fe788f10b4d1f026c38
-
SHA256
267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9
-
SHA512
4e1b8dca0f91b04a1ea7825b83a7498134560af15454e3cc46bb14c16ddb613cfa53d5a2ad97acb68961479a0b914b4b0e53e9a939988654c9e3dc2b3c9e1f5a
-
SSDEEP
1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1LgU:amZ+luXwy2f9LDhDLgU
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 2472 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2060 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2060 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 30 PID 2520 wrote to memory of 2060 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 30 PID 2520 wrote to memory of 2060 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 30 PID 2520 wrote to memory of 2060 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 30 PID 2520 wrote to memory of 2472 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 31 PID 2520 wrote to memory of 2472 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 31 PID 2520 wrote to memory of 2472 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 31 PID 2520 wrote to memory of 2472 2520 267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe"C:\Users\Admin\AppData\Local\Temp\267efb72ec4589473983bc5aa961422ea6b25a63692451376c9dc78e22c93df9N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD526625b4ca7658f7ba4dc7d982782323c
SHA1574aa314998c39e683675ccf457b0305341a4aaf
SHA256c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283
SHA5125a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d
-
Filesize
340B
MD583216fa7c3a8fbc7b3d9ee51e34f1f01
SHA1daaad735ac904d587a2f5a0ad5e1fb5d479429b7
SHA25686195fc0bec550aa4abb97244154862f8bd3b970e678850305b12d2786b30f1b
SHA512d11273f59ed60098b2ffae4945cf8766061f4913b0fc15ddf188d53de9f9b74348598fa4dd3e6aaebcf81f2cd3f53c4d61456b25e28ca341f11d8b2bd56d1493
-
Filesize
57KB
MD5067fcead33f4ff2f26304190154c8ebe
SHA16e68b628083931f8f304f9762b53836794cca80e
SHA256a16c134f31227e995b2afc4144eafa9cdc5b1021123d14012b9bc789a5c7ede2
SHA51232d254308d1bb07fb1ee3e6e6ec4ea832265e0b584d6c9788e2062af4ea8e592c3ab87248196958a23350c3da5503acbbf531c8f6162a70c0ccf8e20dd2c9159