Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 03:40

General

  • Target

    7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe

  • Size

    332KB

  • MD5

    f6635ac29f607998a4c7725fd5eede20

  • SHA1

    cc6eeea7c353e6010700722b37c7a77eb649ccfb

  • SHA256

    7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8

  • SHA512

    07f5074208431a97fe3844bc21c10e2ccfeb3ca480f9ed4076592715c8d64c01773129a26545585dad671b54f84b57c2b67a6708cfad05dc83353c3ec191d9af

  • SSDEEP

    6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVr:vHW138/iXWlK885rKlGSekcj66ciEr

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
    "C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Local\Temp\fuevj.exe
      "C:\Users\Admin\AppData\Local\Temp\fuevj.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\AppData\Local\Temp\tibey.exe
        "C:\Users\Admin\AppData\Local\Temp\tibey.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1976
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    342B

    MD5

    20d0dde02cbbca0903749e4033bae8c5

    SHA1

    d19da8243bce36f392e29c56aa674b3f01b9fe2d

    SHA256

    c3c9fcbb0cf750025fb87e4492d8e7766d079096fed6bbbd1971ea202732a3e5

    SHA512

    0e2070fd38799a0b1d8524604599c22b28327712d18042dced09e41ee176c18bfa16152209ff73c7828149dd6865dffa0504f35c945dae44db6f2fc0b1be2619

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    b91260f31e3d59988d9bc73bcc7ad7ce

    SHA1

    821629b1fefe32c8c78c93fb8f39ca3498155908

    SHA256

    e897e5eb4963633290a423e2cd3adb2c59d76de1cf54ea3914a8028c9920843b

    SHA512

    38f9b289c6d62436ac809a1e6f0074edc15c102232de8eeafe07db77a4a79aa730dc97ffac98076ffe084de40bf5d7640409ba4c8155a572410f84678daeffdd

  • \Users\Admin\AppData\Local\Temp\fuevj.exe

    Filesize

    332KB

    MD5

    840428113d7d722cab072f632d9dbcbe

    SHA1

    77d318a4452e26c4368a03b1ad03cb375b630b05

    SHA256

    99d898a10d43f7080e085266be90f28c955eab7dd67808958611c601b9e192d9

    SHA512

    0c9cec873acdabe719f5743428a89b1b1992bee4776729394fc0ed4ac85d85a08e2f476726939a82c35b589fefb7828d2b6d2900aa30ac85ee133dee3fd5bb72

  • \Users\Admin\AppData\Local\Temp\tibey.exe

    Filesize

    172KB

    MD5

    aba3ea1e556456a9ce9fb4e836d2d282

    SHA1

    437bdb49f5839933bd4e73a0b4ffec0a2af5bd87

    SHA256

    2fbb56f0cbd6c8650598c4bd6f03d97a8cfd20d24f94400d83bd8cf40226ccf6

    SHA512

    8ffdb5ce49efdd2da2108eb9faee455cf344ce45f8cce1db096be9ed9e312f935e8862f2e414ba40fc93850a6b9559e4103e7611167c3d46053c867f9e98c3a0

  • memory/1728-25-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1728-42-0x0000000000240000-0x00000000002C1000-memory.dmp

    Filesize

    516KB

  • memory/1728-19-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1728-38-0x00000000032D0000-0x0000000003369000-memory.dmp

    Filesize

    612KB

  • memory/1728-12-0x0000000000240000-0x00000000002C1000-memory.dmp

    Filesize

    516KB

  • memory/1728-24-0x0000000000240000-0x00000000002C1000-memory.dmp

    Filesize

    516KB

  • memory/1976-43-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-44-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-48-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-49-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-50-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-51-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/1976-52-0x0000000000A20000-0x0000000000AB9000-memory.dmp

    Filesize

    612KB

  • memory/2412-1-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2412-0-0x00000000003B0000-0x0000000000431000-memory.dmp

    Filesize

    516KB

  • memory/2412-9-0x00000000024E0000-0x0000000002561000-memory.dmp

    Filesize

    516KB

  • memory/2412-21-0x00000000003B0000-0x0000000000431000-memory.dmp

    Filesize

    516KB