urelas | fabc8a7e06f38ad7252900b0ca2fb164f78e6b619e872b8728cb4b3530345dda

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe
Size

96KB
MD5

06fbb2ec5d031eb65e3f78ce4798175f
SHA1

b628dffd601f44f7de694649b932ed8bdd7e62b5
SHA256

fabc8a7e06f38ad7252900b0ca2fb164f78e6b619e872b8728cb4b3530345dda
SHA512

4697b9b180d70fff31aa2c9e3c1a2b93a01982321ab3b68e4e42114204d60712baf48c233334821d87e55e83ca338c89a50d22caea9722f0deda3a496385c2ce
SSDEEP

1536:nwhq8V9IpPf2lgiIJ4pivJnuNVueC39GdBR3M9cRGz:nqV9MziU4piRun7C3CP3Mxz

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 3064	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	28
PID 2448 wrote to memory of 3064	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	28
PID 2448 wrote to memory of 3064	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	28
PID 2448 wrote to memory of 3064	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	28
PID 2448 wrote to memory of 2696	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	29
PID 2448 wrote to memory of 2696	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	29
PID 2448 wrote to memory of 2696	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	29
PID 2448 wrote to memory of 2696	2448	NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.06fbb2ec5d031eb65e3f78ce4798175f_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
02167b944a214fee3d34f9a7e356dc6a

SHA1
ca5b3f38a7151268726401593eb35f9b67bdde97

SHA256
77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

SHA512
c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
96KB

MD5
0a81d7fe932cfe2fce6dd747667ac92a

SHA1
527a2c67bd572bba6ef480ec08ee49a1d60ab0bd

SHA256
20c67a848c5e5fac1045541a70e18533de9f72d9f50888468e682a0a96b49b09

SHA512
9661ead20a757cf8278ff5b76e5bc5587418f2e71853e417cf501e844ce4f62c5ab4263ef256c7899497fd7f2891d0ab2aa33ff1c707ca88d0f6d74a813d9d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
97cf976a8886cc677e2001dcac94dec2

SHA1
194085d042444ee434ca0b7334e324d23268176f

SHA256
b31dedf49e7d1aa21a007b0375aa95952c730786df4516e6a9b4ba84abcd7c4a

SHA512
fa622622258f39c4e09e42863f9ddaa3d126d8b2e641895a0a6f3ce687f2715c6214d4a5bee67e98e7aa6006e12b015992bca13a4575391326a39ce9d1442acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
97cf976a8886cc677e2001dcac94dec2

SHA1
194085d042444ee434ca0b7334e324d23268176f

SHA256
b31dedf49e7d1aa21a007b0375aa95952c730786df4516e6a9b4ba84abcd7c4a

SHA512
fa622622258f39c4e09e42863f9ddaa3d126d8b2e641895a0a6f3ce687f2715c6214d4a5bee67e98e7aa6006e12b015992bca13a4575391326a39ce9d1442acb

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
96KB

MD5
0a81d7fe932cfe2fce6dd747667ac92a

SHA1
527a2c67bd572bba6ef480ec08ee49a1d60ab0bd

SHA256
20c67a848c5e5fac1045541a70e18533de9f72d9f50888468e682a0a96b49b09

SHA512
9661ead20a757cf8278ff5b76e5bc5587418f2e71853e417cf501e844ce4f62c5ab4263ef256c7899497fd7f2891d0ab2aa33ff1c707ca88d0f6d74a813d9d20

Download Submit
memory/2448-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-20-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download