Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 11:36

General

  • Target

    1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe

  • Size

    68KB

  • MD5

    209c290527929d775894785ee19232e8

  • SHA1

    d4377346fa464bb497cec55748d96fd6a2cff015

  • SHA256

    1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab

  • SHA512

    5b74f3a9b55f9be4153ac0d0f1bb40c53ba67103e1215e793d3a4912aeb1c028a8b5e5b1ca541fcb37c50396349a45aaa78ddc9d0a33b9e664f8987156191bd6

  • SSDEEP

    1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOrG:l//AjMp+u2onejH2PeEG

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe
    "C:\Users\Admin\AppData\Local\Temp\1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    68KB

    MD5

    c49628e7d73c4b163a000bf11bcab120

    SHA1

    783fadd60545efc6cd3c3e583164779893dc506e

    SHA256

    60109ca0b6fe3eae54610de24bee3a05fd429876d16b37c901888a3ed7cb2097

    SHA512

    8937607e64537da45af908c41c0dc5eecc23f043c1aac945e09d4053b593146712b7fea7bcf9b47ca7f8d6ff89b1b20a93c4c0a97ae16019b7485b36163de2ac

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    a250860c0687ed9dda488805c025a2d2

    SHA1

    0c181ed3b46463d35631ca169f0928c33a1da389

    SHA256

    3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

    SHA512

    0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    93c80a1a4e8acaf2d508a84e72e5e49f

    SHA1

    264b2d1e1b5d110d9443680effebd386b0e5d302

    SHA256

    2b904911274a9c6289e8069264c483b4d0fc2a3ce7fc0bb460c2dc4221c664a3

    SHA512

    8fcdec2e970b771dd084466c7c3dcacb9cb60bfd06f16e7d50aba316a4346cfdf00c71fc3be2de72d6e724e69a2f6994c47261598cb964b3843495885a867eba

  • memory/1852-0-0x00000000005A0000-0x00000000005C8000-memory.dmp

    Filesize

    160KB

  • memory/1852-18-0x00000000005A0000-0x00000000005C8000-memory.dmp

    Filesize

    160KB

  • memory/4844-13-0x0000000000940000-0x0000000000968000-memory.dmp

    Filesize

    160KB

  • memory/4844-21-0x0000000000940000-0x0000000000968000-memory.dmp

    Filesize

    160KB

  • memory/4844-23-0x0000000000940000-0x0000000000968000-memory.dmp

    Filesize

    160KB

  • memory/4844-29-0x0000000000940000-0x0000000000968000-memory.dmp

    Filesize

    160KB