urelas | ebbf37404e5ca10eef0a9149b8c9cb7762beccaa453de116a0cb9afad1c269e0

General

Target

NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe
Size

209KB
MD5

d9e673a4483626cf1234b34de1d251fe
SHA1

afc6a0104e63b5c6c69bcc2153943a789df5bea7
SHA256

ebbf37404e5ca10eef0a9149b8c9cb7762beccaa453de116a0cb9afad1c269e0
SHA512

f96b45f23a24406669d6ee9c0690ae1f13bd9049e1e69313845115ca496a9ca118cfbead773a76e205715c62baf3b5aacc16bf23d5803642451b86569b4c7c1a
SSDEEP

1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcRBRV:PuchogM57bIL+eb61TVa+3MJb6A7

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4340	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4296	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4340	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	89
PID 3588 wrote to memory of 4340	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	89
PID 3588 wrote to memory of 4340	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	89
PID 3588 wrote to memory of 3928	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	90
PID 3588 wrote to memory of 3928	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	90
PID 3588 wrote to memory of 3928	3588	NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d9e673a4483626cf1234b34de1d251feexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3928

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
4d038e4f14781c880a7b7ea60bb22806

SHA1
05e51721fbc91970aada68da6996199680143cd8

SHA256
bcf3c2dc09eb3fdc7d684ce35eee8e56cba5ea6a297d85855e32333c7d3dde23

SHA512
85dd7e1818edba82aa2b16272f9f772eaa16005dad3d6053689c41e9631c0c1d27082270ed4dce25dfe0aaac04bec20ff3293e7e724a3381a172c064d269e780

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
02167b944a214fee3d34f9a7e356dc6a

SHA1
ca5b3f38a7151268726401593eb35f9b67bdde97

SHA256
77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

SHA512
c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
209KB

MD5
e71f3d8259413e16283c14e3b51a77a1

SHA1
de25bd367728aabb9597c8e340c190c37668b31c

SHA256
8e236a3d4d57332fbdc0fbb70945743d038611a29863b599d4b57311d42e08e1

SHA512
56d5c8b74d79f8ddf7ea7105e457799babaf4a3ba4bcc0c8d80209069e457546ab2c10032df06dbf765d888e76ffcecf7a5ac9f70d833bb3a35649fbb39c7ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
209KB

MD5
e71f3d8259413e16283c14e3b51a77a1

SHA1
de25bd367728aabb9597c8e340c190c37668b31c

SHA256
8e236a3d4d57332fbdc0fbb70945743d038611a29863b599d4b57311d42e08e1

SHA512
56d5c8b74d79f8ddf7ea7105e457799babaf4a3ba4bcc0c8d80209069e457546ab2c10032df06dbf765d888e76ffcecf7a5ac9f70d833bb3a35649fbb39c7ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
209KB

MD5
e71f3d8259413e16283c14e3b51a77a1

SHA1
de25bd367728aabb9597c8e340c190c37668b31c

SHA256
8e236a3d4d57332fbdc0fbb70945743d038611a29863b599d4b57311d42e08e1

SHA512
56d5c8b74d79f8ddf7ea7105e457799babaf4a3ba4bcc0c8d80209069e457546ab2c10032df06dbf765d888e76ffcecf7a5ac9f70d833bb3a35649fbb39c7ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
296B

MD5
fcd7765a477272d939d92f00d4322c3b

SHA1
caeb025fe806359ac690f865c5cabff81c44f512

SHA256
236c5c2e3b9c3fa29a7c71bd772103c88993e02898f6a6b011aff8a2834f37c8

SHA512
abe933d5a17f8d529639fd4ccb37ba7a970ed57bb86b90d15f9d3ab2be391530098dc9adbd922e28aefc29bb4a6cf478dd1eb52688faec4a52e646a8c58366fe

Download Submit
memory/3588-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3588-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4296-58-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-61-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-52-0x0000027B7F700000-0x0000027B7F701000-memory.dmp

Filesize
4KB

Download
memory/4296-53-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-54-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-55-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-56-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-57-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-20-0x0000027B7F040000-0x0000027B7F050000-memory.dmp

Filesize
64KB

Download
memory/4296-59-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-60-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-36-0x0000027B7F140000-0x0000027B7F150000-memory.dmp

Filesize
64KB

Download
memory/4296-62-0x0000027B7F730000-0x0000027B7F731000-memory.dmp

Filesize
4KB

Download
memory/4296-63-0x0000027B7F350000-0x0000027B7F351000-memory.dmp

Filesize
4KB

Download
memory/4296-64-0x0000027B7F340000-0x0000027B7F341000-memory.dmp

Filesize
4KB

Download
memory/4296-66-0x0000027B7F350000-0x0000027B7F351000-memory.dmp

Filesize
4KB

Download
memory/4296-69-0x0000027B7F340000-0x0000027B7F341000-memory.dmp

Filesize
4KB

Download
memory/4296-72-0x0000027B7F280000-0x0000027B7F281000-memory.dmp

Filesize
4KB

Download
memory/4296-86-0x0000027B7F490000-0x0000027B7F491000-memory.dmp

Filesize
4KB

Download
memory/4296-84-0x0000027B7F480000-0x0000027B7F481000-memory.dmp

Filesize
4KB

Download
memory/4296-88-0x0000027B7F5A0000-0x0000027B7F5A1000-memory.dmp

Filesize
4KB

Download
memory/4296-87-0x0000027B7F490000-0x0000027B7F491000-memory.dmp

Filesize
4KB

Download
memory/4340-19-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4340-89-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing