Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
Resource
win7-20241023-en
General
-
Target
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
-
Size
332KB
-
MD5
f6635ac29f607998a4c7725fd5eede20
-
SHA1
cc6eeea7c353e6010700722b37c7a77eb649ccfb
-
SHA256
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8
-
SHA512
07f5074208431a97fe3844bc21c10e2ccfeb3ca480f9ed4076592715c8d64c01773129a26545585dad671b54f84b57c2b67a6708cfad05dc83353c3ec191d9af
-
SSDEEP
6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVr:vHW138/iXWlK885rKlGSekcj66ciEr
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
218.54.31.166
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 2504 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1728 fuevj.exe 1976 tibey.exe -
Loads dropped DLL 2 IoCs
pid Process 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 1728 fuevj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fuevj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tibey.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe 1976 tibey.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1728 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 30 PID 2412 wrote to memory of 1728 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 30 PID 2412 wrote to memory of 1728 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 30 PID 2412 wrote to memory of 1728 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 30 PID 2412 wrote to memory of 2504 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 31 PID 2412 wrote to memory of 2504 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 31 PID 2412 wrote to memory of 2504 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 31 PID 2412 wrote to memory of 2504 2412 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 31 PID 1728 wrote to memory of 1976 1728 fuevj.exe 34 PID 1728 wrote to memory of 1976 1728 fuevj.exe 34 PID 1728 wrote to memory of 1976 1728 fuevj.exe 34 PID 1728 wrote to memory of 1976 1728 fuevj.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\fuevj.exe"C:\Users\Admin\AppData\Local\Temp\fuevj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\tibey.exe"C:\Users\Admin\AppData\Local\Temp\tibey.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD520d0dde02cbbca0903749e4033bae8c5
SHA1d19da8243bce36f392e29c56aa674b3f01b9fe2d
SHA256c3c9fcbb0cf750025fb87e4492d8e7766d079096fed6bbbd1971ea202732a3e5
SHA5120e2070fd38799a0b1d8524604599c22b28327712d18042dced09e41ee176c18bfa16152209ff73c7828149dd6865dffa0504f35c945dae44db6f2fc0b1be2619
-
Filesize
512B
MD5b91260f31e3d59988d9bc73bcc7ad7ce
SHA1821629b1fefe32c8c78c93fb8f39ca3498155908
SHA256e897e5eb4963633290a423e2cd3adb2c59d76de1cf54ea3914a8028c9920843b
SHA51238f9b289c6d62436ac809a1e6f0074edc15c102232de8eeafe07db77a4a79aa730dc97ffac98076ffe084de40bf5d7640409ba4c8155a572410f84678daeffdd
-
Filesize
332KB
MD5840428113d7d722cab072f632d9dbcbe
SHA177d318a4452e26c4368a03b1ad03cb375b630b05
SHA25699d898a10d43f7080e085266be90f28c955eab7dd67808958611c601b9e192d9
SHA5120c9cec873acdabe719f5743428a89b1b1992bee4776729394fc0ed4ac85d85a08e2f476726939a82c35b589fefb7828d2b6d2900aa30ac85ee133dee3fd5bb72
-
Filesize
172KB
MD5aba3ea1e556456a9ce9fb4e836d2d282
SHA1437bdb49f5839933bd4e73a0b4ffec0a2af5bd87
SHA2562fbb56f0cbd6c8650598c4bd6f03d97a8cfd20d24f94400d83bd8cf40226ccf6
SHA5128ffdb5ce49efdd2da2108eb9faee455cf344ce45f8cce1db096be9ed9e312f935e8862f2e414ba40fc93850a6b9559e4103e7611167c3d46053c867f9e98c3a0