Analysis
-
max time kernel
90s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 22:44
Behavioral task
behavioral1
Sample
81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe
Resource
win7-20241010-en
General
-
Target
81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe
-
Size
274KB
-
MD5
a153677f0478feae8acc9e7d88da37b0
-
SHA1
491ec8d033805fb58a0879d27521670386ec48fe
-
SHA256
81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11d
-
SHA512
a216626d8a7498bcc247aa20647382202c4cf851bb1dc54b19138636006b1762a318e581b46997bb020c21d2f244a10e98ded600ba68598979fa2980f3f22b7b
-
SSDEEP
3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0wA6c:pOzRWu27dlOd5W0In
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 3064 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2860 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2860 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 29 PID 2164 wrote to memory of 2860 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 29 PID 2164 wrote to memory of 2860 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 29 PID 2164 wrote to memory of 2860 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 29 PID 2164 wrote to memory of 3064 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 30 PID 2164 wrote to memory of 3064 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 30 PID 2164 wrote to memory of 3064 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 30 PID 2164 wrote to memory of 3064 2164 81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe"C:\Users\Admin\AppData\Local\Temp\81faf47e279217ddb4f9ef8f147697c7fb80a1f36464b801c774d34dcb99a11dN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
Filesize
340B
MD543d1b2c5a36d8ab6063058c749b837df
SHA12856eea25d91ecda5549a625025e4ce583d7e12e
SHA25643054ccd9b5cbfd01ac09ac24af0bbc9977068ee730bed59b23124f55688af96
SHA5122d3231ac35476673f242b8368f36c6e4b280684e73c0419dd37114e5999c46f2f433f914005e4390ce69ccf225789eac24fe154d48bef5d606b3f4fecabe4735
-
Filesize
274KB
MD5aea407106c5b2691e92ce666b4a6b235
SHA1e77d801e7d4cc966c158037aed66b5fdacc31fa5
SHA2566bf777b357ef917c6e15b28e0c42fa576cce3da38199999ceb996692a0dfe2f5
SHA51236625352632f72a41e1d633dcbb4a1463bbff8c7304cf5ffe6c72ab91afb5933d925aca8f236de10228ccff4b3522f943f09bd8299d3d4570594643da52e6ccb