Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 08:20

General

  • Target

    2346f7fc466a2579b7db4326b349cd9115c9bde7bc4247ee6492fc011e6b6efd.exe

  • Size

    76KB

  • MD5

    3539c6479ddd574f3caefaf10738f98e

  • SHA1

    118ff084a5b3c6e4d2e5e164e5bd005eae8a5628

  • SHA256

    2346f7fc466a2579b7db4326b349cd9115c9bde7bc4247ee6492fc011e6b6efd

  • SHA512

    b04f27452e6208941039ecf3e3c29bbca97377b78662720983075aae960e8047e812032d06ebe64f413873c96912576df116ceeab6a2145ff2c29dcba9eeb00a

  • SSDEEP

    1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEc:9RkjWjK9ABpGzlaRQLt

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2346f7fc466a2579b7db4326b349cd9115c9bde7bc4247ee6492fc011e6b6efd.exe
    "C:\Users\Admin\AppData\Local\Temp\2346f7fc466a2579b7db4326b349cd9115c9bde7bc4247ee6492fc011e6b6efd.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2712
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    55d2fdd1432483e3ba86ebeccfe130b6

    SHA1

    7280b14d708800fd15303b2caa8628a0fbd7aa08

    SHA256

    5cfd1668ec0e5f3b5f8d04e54091d6f173bede6e6f9bb418819fd550095139fb

    SHA512

    36fd81128552356672b52936699c5e6362268c8131857e778e02a6862600c4feb20d13063d5f838e0887cb5083c648d39fe07faffba18c26387760752f9dd1f3

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    1c783268e0139e7589167442a5044617

    SHA1

    ce3b3d76d3f26595ff7b1782dd2264e5b8481eb5

    SHA256

    466194af281de5da18af82d2428b65f521d5d0923bc35749c9be4c615f3e6020

    SHA512

    e63d69188045f70522486648d3d087df834c3b96881977d72a8aae1959a9cd3e060520de605146eda32a7b840b18f999f26693efaa54d212a1c2b3ea9e35b2ba

  • \Users\Admin\AppData\Local\Temp\huter.exe

    Filesize

    76KB

    MD5

    4da59f0c133609dd21be3f4ee6c55359

    SHA1

    344dc04ba49e4cfef2fed40fed555e55481a0451

    SHA256

    75f43987f463f1eb89123144c5f449d9eb75e4ac33a0f0f8451c10e993b20bdf

    SHA512

    8cdbb7a04355b0a68f22b825ce42e10a665f61a8f871ef2e7ac9c5c4c4af52ae29a48d8ffcd0ae650cbcf0c9288d9451e7b405c8b9e03582a44db66b2f34cf85

  • memory/2688-0-0x00000000008A0000-0x00000000008D1000-memory.dmp

    Filesize

    196KB

  • memory/2688-6-0x0000000001F70000-0x0000000001FA1000-memory.dmp

    Filesize

    196KB

  • memory/2688-18-0x00000000008A0000-0x00000000008D1000-memory.dmp

    Filesize

    196KB

  • memory/2712-10-0x0000000001090000-0x00000000010C1000-memory.dmp

    Filesize

    196KB

  • memory/2712-21-0x0000000001090000-0x00000000010C1000-memory.dmp

    Filesize

    196KB

  • memory/2712-23-0x0000000001090000-0x00000000010C1000-memory.dmp

    Filesize

    196KB

  • memory/2712-25-0x0000000001090000-0x00000000010C1000-memory.dmp

    Filesize

    196KB