urelas | 48c977d3a1e9bbc7b29b162574cc573213bd8cb4c4e06c52fc46ea48fff89a5b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-09-2023 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

618ac6d1589cb78955bfa5ad969f59a1_JC.exe
Size

467KB
MD5

618ac6d1589cb78955bfa5ad969f59a1
SHA1

2181bf81988d24c067c9b95f715d505b02bed07c
SHA256

48c977d3a1e9bbc7b29b162574cc573213bd8cb4c4e06c52fc46ea48fff89a5b
SHA512

a885ab042c93b00e3798364e6f61ef800994ce917e52efe12996abae9077308174ec33de1e6e66ecea514c4a4f58f92f24b26d302af84bb374e2c70df5345bd0
SSDEEP

12288:93CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mP:9x9GzHlTv/b35tecFB6C

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

121.88.5.184

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1036	sander.exe

Loads dropped DLL 1 IoCs

pid	Process
1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1036	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	28
PID 1252 wrote to memory of 1036	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	28
PID 1252 wrote to memory of 1036	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	28
PID 1252 wrote to memory of 1036	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	28
PID 1252 wrote to memory of 2712	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	29
PID 1252 wrote to memory of 2712	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	29
PID 1252 wrote to memory of 2712	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	29
PID 1252 wrote to memory of 2712	1252	618ac6d1589cb78955bfa5ad969f59a1_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\618ac6d1589cb78955bfa5ad969f59a1_JC.exe
"C:\Users\Admin\AppData\Local\Temp\618ac6d1589cb78955bfa5ad969f59a1_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - Deletes itself
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
283B

MD5
eca56e881be090bbabfaa0d99e3d2e75

SHA1
caae1fec7bdb91d74e4fd229af8f8f4c200fadb9

SHA256
43b58cfdb33f3ea8b28e536924dff6cab2c0e5c44ef4ab7927275e7c05f9eae5

SHA512
6f7f2afe5d14fb81e84c8d94f8d491d32909b3a77eef80968935d5614251def30dd50866cf73b5f62bdfc5785908f9f409ed02b74082653093631a802665af0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
283B

MD5
eca56e881be090bbabfaa0d99e3d2e75

SHA1
caae1fec7bdb91d74e4fd229af8f8f4c200fadb9

SHA256
43b58cfdb33f3ea8b28e536924dff6cab2c0e5c44ef4ab7927275e7c05f9eae5

SHA512
6f7f2afe5d14fb81e84c8d94f8d491d32909b3a77eef80968935d5614251def30dd50866cf73b5f62bdfc5785908f9f409ed02b74082653093631a802665af0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
145cec05d8d704ff7aa3d812b1aff628

SHA1
097ae09965ed3804359803708b8af87b5b90fcbb

SHA256
66c8ae290d7cf992faf67b10d1ef8ad91857f3709f459af69b6a11f521a3aeea

SHA512
1037d7926aec2831c8b084cc19aa38ce91bc8dcff15af731ce0e7cea79fa7806d4d341a9535c39b0ccb8d6f19bc2badf6d20d3b4ab1c931cd5be6994c4323b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
467KB

MD5
f94a2b1d02033114769f8560e00fbe63

SHA1
dc3c2f268fbc52379b72d64d45e79303a5aafb48

SHA256
87b4d87afc83820817fff8cff5d7c3a6b8b9b866a84e1136136dd2b16856a0f9

SHA512
52acecb4f2d44fab6ae2cd25af70894a0ce459134d8043c3d24e80da21aa51a4a34cd6f98e319a044ff0df188476d6b70abbc33f0ed349e6c70710105eb0bc7e

Download Submit
\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
467KB

MD5
f94a2b1d02033114769f8560e00fbe63

SHA1
dc3c2f268fbc52379b72d64d45e79303a5aafb48

SHA256
87b4d87afc83820817fff8cff5d7c3a6b8b9b866a84e1136136dd2b16856a0f9

SHA512
52acecb4f2d44fab6ae2cd25af70894a0ce459134d8043c3d24e80da21aa51a4a34cd6f98e319a044ff0df188476d6b70abbc33f0ed349e6c70710105eb0bc7e

Download Submit
memory/1036-19-0x0000000000CF0000-0x0000000000D72000-memory.dmp

Filesize
520KB

Download
memory/1036-23-0x0000000000CF0000-0x0000000000D72000-memory.dmp

Filesize
520KB

Download
memory/1036-24-0x0000000000CF0000-0x0000000000D72000-memory.dmp

Filesize
520KB

Download
memory/1252-0-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/1252-1-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download
memory/1252-9-0x0000000002640000-0x00000000026C2000-memory.dmp

Filesize
520KB

Download
memory/1252-20-0x0000000000080000-0x0000000000102000-memory.dmp

Filesize
520KB

Download