Analysis

  • max time kernel
    94s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 09:15

General

  • Target

    83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e.exe

  • Size

    51KB

  • MD5

    5a8ebbdc35e6a3caecfa66340826e192

  • SHA1

    0969613872152b004fe0bcb876ac384782ce8f4f

  • SHA256

    83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e

  • SHA512

    0a5ed23df12d2763119c08fdf7f50882369f33f96fcdab6f66b728a262e307f212f370b8208fc048feaa4e6cbfc905335e6dd9ad8a637acad43709024e78092c

  • SSDEEP

    1536:h+Ds6ClDXuqweo/0khAUnJDgabGsVy6umfFlPhP4:KsdXfBo/DBJBGzkP5P4

Score
10/10

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

218.54.28.139

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e.exe
    "C:\Users\Admin\AppData\Local\Temp\83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Local\Temp\shoste.exe
      "C:\Users\Admin\AppData\Local\Temp\shoste.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1720
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    f51c1462254f3bb8aa00201af0b0a030

    SHA1

    60d3c892bb5c4f654c318451012f936d81164418

    SHA256

    695c02a7ab1d4a3bf5060ab1c7c63f651dc1fd945c0c5c3263c23db769f689c5

    SHA512

    41059643033b10394b1593371e22542e4b7f504a3da36ca2cdbf28521dd24bd70d70f42c99f580227e9799c64b5c23c7b9182ca518245b66eb831868e043e0b0

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    be98a3158867a8fe04e07ebce0eeae08

    SHA1

    cf765a52146109fd458e6df6b3177cf75ac6e418

    SHA256

    f7c7940951ae8891c8b1488e83b2cfac13d7d8cdda918426e62ba521b063f7cd

    SHA512

    3eb17473ef08e7755a605380398d085efb103005c29b4fc143a5e5f96aba44cdd58eba6f0efdff674c40d10020a05745ca9ab10fd4d0ce37e06e816d9f2deae0

  • C:\Users\Admin\AppData\Local\Temp\shoste.exe

    Filesize

    51KB

    MD5

    acf867fbe1d5196c7428db2e89d42aae

    SHA1

    b45cb916c3845570c42ba805c03d81acc5dca590

    SHA256

    613b0c6447697cb4c17643eb13085b75ef7ee524e686a3286b02c4acaf1de9f6

    SHA512

    aeca3e48c95b69e12e047f1fc4a5dd1a0f4ddedd5b049978417f11a02597a96f90108641290d518ef353673d8f8c37c27afa5cc13fa8c33eadc8f5820be9d7b3

  • memory/1720-12-0x00000000007B0000-0x00000000007E5000-memory.dmp

    Filesize

    212KB

  • memory/1720-18-0x00000000007B0000-0x00000000007E5000-memory.dmp

    Filesize

    212KB

  • memory/1720-25-0x00000000007B0000-0x00000000007E5000-memory.dmp

    Filesize

    212KB

  • memory/2088-0-0x0000000000F50000-0x0000000000F85000-memory.dmp

    Filesize

    212KB

  • memory/2088-15-0x0000000000F50000-0x0000000000F85000-memory.dmp

    Filesize

    212KB