Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 02:09

General

  • Target

    1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe

  • Size

    52KB

  • MD5

    eb71479977873ddd18b7b92c961f5c90

  • SHA1

    3beb9a164c32065d3c41572cfc7b0e0b7c8dccdc

  • SHA256

    1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7d

  • SHA512

    64fd33316114e8d3d1f74b7573b860f752659ae107b01ded4e2722927cd855824b64ba09f5ea284d4007ebc32f2c3afcf4aa7656a77d197b73f8df03989fc84d

  • SSDEEP

    1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrg1:vMhAe5Zs091KI+JYixw49XjrE

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe
    "C:\Users\Admin\AppData\Local\Temp\1f4ffae1d208aa2da2fc5364702a0999f92db988820b695c723fd34fb514df7dN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    52KB

    MD5

    5da77a40e3e0897d7a6f018e9f5caa1d

    SHA1

    521266b36dde74467dce2156b86e265fd124afef

    SHA256

    7a8cba4b3394d35fd5fc53cafae1342e876c8fb45830b71482cb11fe21227fac

    SHA512

    173f2f6fffa3ee24b40c23ab6d4488d79cfeaabd418a3175a9eb20604976eddc1f444e324310ca21b2f18ca998c14de98f94e03b5bb9dc4d4b9ee64b31d2887c

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    b4a86880004da8726288d7ec954885a8

    SHA1

    1bab1cfbdc2c540246210bc7852f8fe7e8357b31

    SHA256

    c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46

    SHA512

    22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    340B

    MD5

    3a261c304ad728005c2a56c0e6ea04a0

    SHA1

    6a4bf525414afe8d6557429cd023f9ab47ac32ce

    SHA256

    9afcbec815edd595982554aa66d10d106546335bf9b5553db39415bd6f8485b9

    SHA512

    a71aad635e5b2579373781be5f9396836495c17620173dd230a742b3211ad8ded422f4066f9f7385a15c19854f66b5bcc8c2cc6dc55835092760e8e808abc5ec

  • memory/1312-10-0x0000000000120000-0x0000000000146000-memory.dmp

    Filesize

    152KB

  • memory/1312-18-0x0000000000120000-0x0000000000146000-memory.dmp

    Filesize

    152KB

  • memory/1312-20-0x0000000000120000-0x0000000000146000-memory.dmp

    Filesize

    152KB

  • memory/1312-26-0x0000000000120000-0x0000000000146000-memory.dmp

    Filesize

    152KB

  • memory/4764-0-0x0000000000A40000-0x0000000000A66000-memory.dmp

    Filesize

    152KB

  • memory/4764-15-0x0000000000A40000-0x0000000000A66000-memory.dmp

    Filesize

    152KB