Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2025, 15:26 UTC

General

  • Target

    8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe

  • Size

    92KB

  • MD5

    edb353c93c01a6c2e9f09a3f448a541d

  • SHA1

    f1f676b32e3ac1986609f29a6e0a3027dd7df672

  • SHA256

    8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd

  • SHA512

    5f7c8a285a943e2f0cf347e8828b26135c3b4d03da13f5d7e4d842bd1cf2c0d1561802bb0d1a7faf1bf0a799136ff45cde88d982118d0fac1f692f80aa0d864e

  • SSDEEP

    768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwD7:heZqP25TuIfmS7Fv1aUZSD9yiIHav

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
    "C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\poldge.exe
      "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4408
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1132

Network

  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    159.96.196.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    159.96.196.23.in-addr.arpa
    IN PTR
    Response
    159.96.196.23.in-addr.arpa
    IN PTR
    a23-196-96-159deploystaticakamaitechnologiescom
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • 121.88.5.183:11150
    poldge.exe
    260 B
    5
  • 121.88.5.184:11170
    poldge.exe
    260 B
    5
  • 218.54.28.240:11150
    poldge.exe
    260 B
    5
  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    159.96.196.23.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    159.96.196.23.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    3f372385bf24b44385f4b1251d3aca4d

    SHA1

    83546de6ba8f20bd08a15896d34f6242ed64352f

    SHA256

    b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

    SHA512

    d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

  • C:\Users\Admin\AppData\Local\Temp\poldge.exe

    Filesize

    92KB

    MD5

    5153996c8397c9f4e1ac10d298cc1b55

    SHA1

    79ad9548ed3e1ba7f914442bdd012c4bbc6b5fe8

    SHA256

    8705956fcb72b79e07184885f9533d93a0aafaefaa7776efa9135fc2a2677e53

    SHA512

    a573e230ff1c9f9c8d6e9d60d7c85e2bbf925306dc306e8aa3436066d9d909300c39f7b653babffa55780c28888d228520f605620d3dbfd85419b432e119b6c6

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    338B

    MD5

    7c2751929f4eeb92ade834d248663e03

    SHA1

    2f1853d76a42aa4ae2c7063d8429ce259954e27f

    SHA256

    fa0f89e1b21db0c9c4a791e9a85aa831f24df1537e2459ca7110167c267099f8

    SHA512

    e868c4b51d59c51a8d76b927265ca02d2536addc26fc70ea5e97946a15dd0877820d397363135d0899e5a34b157d115579659f8b8e25d9cc38e080c0709cf50e

  • memory/4408-16-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4408-22-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4984-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/4984-13-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.