Analysis

  • max time kernel
    90s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 22:44

General

  • Target

    81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe

  • Size

    274KB

  • MD5

    a153677f0478feae8acc9e7d88da37b0

  • SHA1

    491ec8d033805fb58a0879d27521670386ec48fe

  • SHA256

    81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11d

  • SHA512

    a216626d8a7498bcc247aa20647382202c4cf851bb1dc54b19138636006b1762a318e581b46997bb020c21d2f244a10e98ded600ba68598979fa2980f3f22b7b

  • SSDEEP

    3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0wA6c:pOzRWu27dlOd5W0In

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe
    "C:\Users\Admin\AppData\Local\Temp\81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2860
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    ac5e84ed8031d66a9fcd5e472ba8091b

    SHA1

    06303add604104d6abbb69458f89773c066b470c

    SHA256

    3a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5

    SHA512

    7bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    43d1b2c5a36d8ab6063058c749b837df

    SHA1

    2856eea25d91ecda5549a625025e4ce583d7e12e

    SHA256

    43054ccd9b5cbfd01ac09ac24af0bbc9977068ee730bed59b23124f55688af96

    SHA512

    2d3231ac35476673f242b8368f36c6e4b280684e73c0419dd37114e5999c46f2f433f914005e4390ce69ccf225789eac24fe154d48bef5d606b3f4fecabe4735

  • \Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    274KB

    MD5

    aea407106c5b2691e92ce666b4a6b235

    SHA1

    e77d801e7d4cc966c158037aed66b5fdacc31fa5

    SHA256

    6bf777b357ef917c6e15b28e0c42fa576cce3da38199999ceb996692a0dfe2f5

    SHA512

    36625352632f72a41e1d633dcbb4a1463bbff8c7304cf5ffe6c72ab91afb5933d925aca8f236de10228ccff4b3522f943f09bd8299d3d4570594643da52e6ccb

  • memory/2164-0-0x0000000000E30000-0x0000000000E76000-memory.dmp

    Filesize

    280KB

  • memory/2164-6-0x0000000000B80000-0x0000000000BC6000-memory.dmp

    Filesize

    280KB

  • memory/2164-17-0x0000000000E30000-0x0000000000E76000-memory.dmp

    Filesize

    280KB

  • memory/2860-20-0x0000000000950000-0x0000000000996000-memory.dmp

    Filesize

    280KB

  • memory/2860-21-0x0000000000950000-0x0000000000996000-memory.dmp

    Filesize

    280KB