Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
Resource
win7-20241023-en
General
-
Target
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
-
Size
332KB
-
MD5
f6635ac29f607998a4c7725fd5eede20
-
SHA1
cc6eeea7c353e6010700722b37c7a77eb649ccfb
-
SHA256
7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8
-
SHA512
07f5074208431a97fe3844bc21c10e2ccfeb3ca480f9ed4076592715c8d64c01773129a26545585dad671b54f84b57c2b67a6708cfad05dc83353c3ec191d9af
-
SSDEEP
6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVr:vHW138/iXWlK885rKlGSekcj66ciEr
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
218.54.31.166
Signatures
-
Urelas family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation deseb.exe -
Executes dropped EXE 2 IoCs
pid Process 1828 deseb.exe 1108 kupus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deseb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kupus.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe 1108 kupus.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 60 wrote to memory of 1828 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 88 PID 60 wrote to memory of 1828 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 88 PID 60 wrote to memory of 1828 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 88 PID 60 wrote to memory of 4140 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 90 PID 60 wrote to memory of 4140 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 90 PID 60 wrote to memory of 4140 60 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe 90 PID 1828 wrote to memory of 1108 1828 deseb.exe 102 PID 1828 wrote to memory of 1108 1828 deseb.exe 102 PID 1828 wrote to memory of 1108 1828 deseb.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\deseb.exe"C:\Users\Admin\AppData\Local\Temp\deseb.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\kupus.exe"C:\Users\Admin\AppData\Local\Temp\kupus.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:4140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD520d0dde02cbbca0903749e4033bae8c5
SHA1d19da8243bce36f392e29c56aa674b3f01b9fe2d
SHA256c3c9fcbb0cf750025fb87e4492d8e7766d079096fed6bbbd1971ea202732a3e5
SHA5120e2070fd38799a0b1d8524604599c22b28327712d18042dced09e41ee176c18bfa16152209ff73c7828149dd6865dffa0504f35c945dae44db6f2fc0b1be2619
-
Filesize
332KB
MD5bfbb016642de9a2c1476451ddc0553d4
SHA1c1b0217e366a244bff57fd26b7e0ad9d17d225d4
SHA25684d4bb462cc85fd20114166478683388617f214befeafa94056360146cb68f61
SHA512e1b729f8bbcd7c2a2067f02b2d2125f7a0d33dcaa0ee2f432076af39500668c2cd466a06b549ddbd7aab546ecb166d96a0dad5282fb7b518126db855c509b86b
-
Filesize
512B
MD56daab9feb3138247726b1f4c0cee5658
SHA122a112929fa897a0f4334042781999ae31d53607
SHA2560e6b2e53d3b1b6d76f36aea594ad700a322e12c020c3c9af02a9c90ac3aa5acf
SHA5125d6799ad878dd70e81eebd7a76cc58c393341cecb57c5f18155fe7ff869355dd02362371d641a500e5e1d318c1142d7aead2302a922cfd9169fc3221631f074d
-
Filesize
172KB
MD5492b860abbb3e2d8e8f1b12a3c1be515
SHA194fb1d108eddfef6ecefa9d9f274add83dc633cc
SHA2568ea82f02bb5b69d16fb2381ba91d41eff7864846975cb171fbafa1c15b34dcd9
SHA512adea9f400dc5bcf77f50207a1e50577150c08ccff77f7116628de5d738d77a9e679abc8cb129fa0a037e0fbc45b54d67e41fd73d565888af15189fc125413e59