Analysis

  • max time kernel
    4s
  • max time network
    87s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 06:42

General

  • Target

    57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe

  • Size

    80KB

  • MD5

    9fe7296e75e0c51c0820d92acd13db8a

  • SHA1

    2b66c697c8d54a69bf10d11c1a30e1ebad23b552

  • SHA256

    57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd

  • SHA512

    6ccfb426e711d0834a8829f8dbc369fe83128d6e52c56882bf3cf95bee7cdc27d89639f424e34ffa32145a3063b52943e6c2d0510239b8927cb6024f8bed8f4f

  • SSDEEP

    1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te7s:4lnhYPlVMqmyAFIRRes

Score
10/10

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
    "C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Users\Admin\AppData\Local\Temp\huter.exe
      "C:\Users\Admin\AppData\Local\Temp\huter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2336
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    dd1155cbc9956e5dbeee97b18e3c4c5a

    SHA1

    e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

    SHA256

    53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

    SHA512

    1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

  • C:\Users\Admin\AppData\Local\Temp\huter.exe

    Filesize

    80KB

    MD5

    bbe2206ad48fea9172539061ca1ec868

    SHA1

    43f637261d0b958d0fb312250c05a60e330a4490

    SHA256

    52f871bfa333c895136ca22f4b5b1b010574d6fe9d4434d4396ce6bed4d61820

    SHA512

    9bb49dd314270e924a91999d2ddec94b6182c70931b315a99fdfa68552c6f52783b94e2604012beb19af5308ba68413d366f7da44f0f05f0083124ef40d0acb9

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    525e8b45693a85514056a2575bcf3c8a

    SHA1

    c2d7515b4ae24bb2aa6e3f739523b90dedb8ebb2

    SHA256

    10ee06d523da027564e0fd368af0dc69298e6f7debb07a78a84e811128d24b43

    SHA512

    edf012e61139dc80afe6d76f8a6d04cac88799c74fcba8abcd9d4528c3d1c3d46e7fdc6f864c6480f6de32b33cbbec7a7d60bf4722e970a40998941761698c5f

  • memory/876-0-0x0000000001280000-0x00000000012B0000-memory.dmp

    Filesize

    192KB

  • memory/876-19-0x0000000001280000-0x00000000012B0000-memory.dmp

    Filesize

    192KB

  • memory/876-6-0x0000000000410000-0x0000000000440000-memory.dmp

    Filesize

    192KB

  • memory/2336-11-0x0000000001220000-0x0000000001250000-memory.dmp

    Filesize

    192KB

  • memory/2336-22-0x0000000001220000-0x0000000001250000-memory.dmp

    Filesize

    192KB

  • memory/2336-24-0x0000000001220000-0x0000000001250000-memory.dmp

    Filesize

    192KB

  • memory/2336-30-0x0000000001220000-0x0000000001250000-memory.dmp

    Filesize

    192KB