Analysis
-
max time kernel
4s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
Resource
win7-20240903-en
General
-
Target
57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
-
Size
80KB
-
MD5
9fe7296e75e0c51c0820d92acd13db8a
-
SHA1
2b66c697c8d54a69bf10d11c1a30e1ebad23b552
-
SHA256
57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd
-
SHA512
6ccfb426e711d0834a8829f8dbc369fe83128d6e52c56882bf3cf95bee7cdc27d89639f424e34ffa32145a3063b52943e6c2d0510239b8927cb6024f8bed8f4f
-
SSDEEP
1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te7s:4lnhYPlVMqmyAFIRRes
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 1424 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2336 huter.exe -
Loads dropped DLL 1 IoCs
pid Process 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 876 wrote to memory of 2336 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 31 PID 876 wrote to memory of 2336 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 31 PID 876 wrote to memory of 2336 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 31 PID 876 wrote to memory of 2336 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 31 PID 876 wrote to memory of 1424 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 32 PID 876 wrote to memory of 1424 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 32 PID 876 wrote to memory of 1424 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 32 PID 876 wrote to memory of 1424 876 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe"C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5dd1155cbc9956e5dbeee97b18e3c4c5a
SHA1e5f61bc0d1bc9ad93206ea16ddefca0900ea780c
SHA25653be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7
SHA5121e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce
-
Filesize
80KB
MD5bbe2206ad48fea9172539061ca1ec868
SHA143f637261d0b958d0fb312250c05a60e330a4490
SHA25652f871bfa333c895136ca22f4b5b1b010574d6fe9d4434d4396ce6bed4d61820
SHA5129bb49dd314270e924a91999d2ddec94b6182c70931b315a99fdfa68552c6f52783b94e2604012beb19af5308ba68413d366f7da44f0f05f0083124ef40d0acb9
-
Filesize
338B
MD5525e8b45693a85514056a2575bcf3c8a
SHA1c2d7515b4ae24bb2aa6e3f739523b90dedb8ebb2
SHA25610ee06d523da027564e0fd368af0dc69298e6f7debb07a78a84e811128d24b43
SHA512edf012e61139dc80afe6d76f8a6d04cac88799c74fcba8abcd9d4528c3d1c3d46e7fdc6f864c6480f6de32b33cbbec7a7d60bf4722e970a40998941761698c5f