Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 02:09

General

  • Target

    1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe

  • Size

    52KB

  • MD5

    eb71479977873ddd18b7b92c961f5c90

  • SHA1

    3beb9a164c32065d3c41572cfc7b0e0b7c8dccdc

  • SHA256

    1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7d

  • SHA512

    64fd33316114e8d3d1f74b7573b860f752659ae107b01ded4e2722927cd855824b64ba09f5ea284d4007ebc32f2c3afcf4aa7656a77d197b73f8df03989fc84d

  • SSDEEP

    1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrg1:vMhAe5Zs091KI+JYixw49XjrE

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
    "C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2788
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    b4a86880004da8726288d7ec954885a8

    SHA1

    1bab1cfbdc2c540246210bc7852f8fe7e8357b31

    SHA256

    c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46

    SHA512

    22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    3a261c304ad728005c2a56c0e6ea04a0

    SHA1

    6a4bf525414afe8d6557429cd023f9ab47ac32ce

    SHA256

    9afcbec815edd595982554aa66d10d106546335bf9b5553db39415bd6f8485b9

    SHA512

    a71aad635e5b2579373781be5f9396836495c17620173dd230a742b3211ad8ded422f4066f9f7385a15c19854f66b5bcc8c2cc6dc55835092760e8e808abc5ec

  • \Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    52KB

    MD5

    2c5810f8d70faf1a7a82d9e1b3accb2f

    SHA1

    6d52b5fb324623d66bcee1b14b2efd7900bbb51a

    SHA256

    1aa02f23be30aee41ac9763bfe421ec443295566a8991519fe2b58dc4fdd1912

    SHA512

    e839465ffe0e12b339e8a710bf31ae65cd62fa1570d7291a32f270531c29bd753f4c99f34604b412e4043be9f53b7bcc903954fa63a851373c49b80355bcc3a0

  • memory/1388-0-0x00000000013A0000-0x00000000013C6000-memory.dmp

    Filesize

    152KB

  • memory/1388-6-0x0000000000390000-0x00000000003B6000-memory.dmp

    Filesize

    152KB

  • memory/1388-19-0x00000000013A0000-0x00000000013C6000-memory.dmp

    Filesize

    152KB

  • memory/2788-10-0x0000000001140000-0x0000000001166000-memory.dmp

    Filesize

    152KB

  • memory/2788-22-0x0000000001140000-0x0000000001166000-memory.dmp

    Filesize

    152KB

  • memory/2788-24-0x0000000001140000-0x0000000001166000-memory.dmp

    Filesize

    152KB

  • memory/2788-31-0x0000000001140000-0x0000000001166000-memory.dmp

    Filesize

    152KB