Edit tour

Windows Analysis Report
A0cYOljhtv.exe

Overview

General Information

Sample name:	A0cYOljhtv.exe renamed because original name is a hash value
Original sample name:	83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e.exe
Analysis ID:	1556510
MD5:	5a8ebbdc35e6a3caecfa66340826e192
SHA1:	0969613872152b004fe0bcb876ac384782ce8f4f
SHA256:	83b591f5ea6d9131d736b8fbf255ff5f691d84ad8625778f959295764575067e
Tags:	exeUrelasuser-JAMESWT_MHT
Infos:

Detection

Urelas

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Urelas

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Entry point lies outside standard sections

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

A0cYOljhtv.exe (PID: 4348 cmdline: "C:\Users\user\Desktop\A0cYOljhtv.exe" MD5: 5A8EBBDC35E6A3CAECFA66340826E192)

shoste.exe (PID: 1196 cmdline: "C:\Users\user~1\AppData\Local\Temp\shoste.exe" MD5: 7FED5B8CF3EE76D62566D7C80BEB528D)

cmd.exe (PID: 1792 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\sanfdr.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: Urelas

{"C2 url": ["218.54.28.139", "121.88.5.183"], "Drop filename": ["histe", "shoste"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1285834333.0000000000841000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Urelas	Yara detected Urelas	Joe Security
00000008.00000002.1486563563.00000000008B1000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Urelas	Yara detected Urelas	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.A0cYOljhtv.exe.840000.0.unpack	JoeSecurity_Urelas	Yara detected Urelas	Joe Security
8.2.shoste.exe.8b0000.0.unpack	JoeSecurity_Urelas	Yara detected Urelas	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\shoste.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\A0cYOljhtv.exe, ProcessId: 4348, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\shoste.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\shoste.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\shoste.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\shoste.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\shoste.exe, ParentCommandLine: "C:\Users\user\Desktop\A0cYOljhtv.exe", ParentImage: C:\Users\user\Desktop\A0cYOljhtv.exe, ParentProcessId: 4348, ParentProcessName: A0cYOljhtv.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\shoste.exe" , ProcessId: 1196, ProcessName: shoste.exe

Suricata Signatures

ETPRO MALWARE Rootkit.Win32.Bootkor.ha CnC Traffic

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T14:57:21.415274+0100	2804923	1	Malware Command and Control Activity Detected	192.168.2.7	49700	121.88.5.183	11120	TCP
2024-11-15T14:57:29.909899+0100	2804923	1	Malware Command and Control Activity Detected	192.168.2.7	49717	121.88.5.184	11170	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: A0cYOljhtv.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\shoste.exe

Avira: detection malicious, Label: BDS/Backdoor.Gen7

Found malware configuration

Source: golfinfo.ini.0.dr

Malware Configuration Extractor: Urelas {"C2 url": ["218.54.28.139", "121.88.5.183"], "Drop filename": ["histe", "shoste"]}

Multi AV Scanner detection for submitted file

Source: A0cYOljhtv.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\shoste.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: A0cYOljhtv.exe

Joe Sandbox ML: detected

Source: A0cYOljhtv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: A0cYOljhtv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2804923 - Severity 1 - ETPRO MALWARE Rootkit.Win32.Bootkor.ha CnC Traffic : 192.168.2.7:49717 -> 121.88.5.184:11170
Source: Network traffic	Suricata IDS: 2804923 - Severity 1 - ETPRO MALWARE Rootkit.Win32.Bootkor.ha CnC Traffic : 192.168.2.7:49700 -> 121.88.5.183:11120

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 218.54.28.139
Source: Malware configuration extractor	IPs: 121.88.5.183

Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 121.88.5.183:11120
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 121.88.5.184:11170

Source: Joe Sandbox View	ASN Name: CNM-AS-KRDLIVEKR CNM-AS-KRDLIVEKR
Source: Joe Sandbox View	ASN Name: CNM-AS-KRDLIVEKR CNM-AS-KRDLIVEKR
Source: Joe Sandbox View	ASN Name: SKB-ASSKBroadbandCoLtdKR SKB-ASSKBroadbandCoLtdKR

Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.183
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.183
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.183
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.183
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.183
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184
Source: unknown	TCP traffic detected without corresponding DNS query: 121.88.5.184

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

Code function: 0_2_008443C9 recv,_memmove,

0_2_008443C9

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

Code function: 0_2_00842E60: CreateFileW,DeviceIoControl,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,CloseHandle,

0_2_00842E60

Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Code function: String function: 008B7650 appears 31 times
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Code function: String function: 00847650 appears 31 times

Source: A0cYOljhtv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@0/3

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2020:120:WilError_03

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

File created: C:\Users\user~1\AppData\Local\Temp\golfinfo.ini

Jump to behavior

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\sanfdr.bat" "

Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Command line argument: Foilde	0_2_00841000
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Command line argument: Foilde	0_2_00841000
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Command line argument: 218.54.31.226	0_2_00841000
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Command line argument: tmp5RST.exe	0_2_00841000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: Foilde	8_2_008B1000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: Foilde	8_2_008B1000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: 121.88.5.183	8_2_008B1000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: tmp5RST.exe	8_2_008B1000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: tmp5RST.exe	8_2_008B1000
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Command line argument: tmp5RST.exe	8_2_008B1000

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: A0cYOljhtv.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

File read: C:\Users\user\Desktop\A0cYOljhtv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\A0cYOljhtv.exe "C:\Users\user\Desktop\A0cYOljhtv.exe"
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Process created: C:\Users\user\AppData\Local\Temp\shoste.exe "C:\Users\user~1\AppData\Local\Temp\shoste.exe"
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\sanfdr.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Process created: C:\Users\user\AppData\Local\Temp\shoste.exe "C:\Users\user~1\AppData\Local\Temp\shoste.exe"	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\sanfdr.bat" "	Jump to behavior

Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\A0cYOljhtv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shoste.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\A0cYOljhtv.exe

File written: C:\Users\user\AppData\Local\Temp\golfinfo.ini

Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
A0cYOljhtv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Urelas

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report A0cYOljhtv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Urelas

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Windows Analysis Report
A0cYOljhtv.exe