urelas | 1bc7be609a83bfa86ee69afd364420968cf6e37e4f2720e61c2b2fd70fb7a8ec

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe
Size

141KB
MD5

a104af8e0067fd605e098d1b24e13410
SHA1

c881014e7aadc7ebed912f1d07d25a4109b9ab3e
SHA256

1bc7be609a83bfa86ee69afd364420968cf6e37e4f2720e61c2b2fd70fb7a8ec
SHA512

0b7db8820505dd289afcd898256c8228d9693f3433f6ee14d89348839762397625deb15b15c51ec2e539a086a5fabc8f225b4b8634fc7b027aa48486cc7fd190
SSDEEP

3072:K3kHmMsmRUOMfCECCeZlmgchdvz6xs9PY0X85jx08aAP52jKR2jKqRWQ:zHbRUOqwC4mgg44jKojKqRb

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2756	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	rkfc.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2716	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	28
PID 2888 wrote to memory of 2716	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	28
PID 2888 wrote to memory of 2716	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	28
PID 2888 wrote to memory of 2716	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	28
PID 2888 wrote to memory of 2756	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	29
PID 2888 wrote to memory of 2756	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	29
PID 2888 wrote to memory of 2756	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	29
PID 2888 wrote to memory of 2756	2888	NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a104af8e0067fd605e098d1b24e13410_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\rkfc.exe
  "C:\Users\Admin\AppData\Local\Temp\rkfc.exe"
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
4b1300debfd02ba9d6c7cba3fd7f7773

SHA1
1ecbc29ae3f25e7feb04cb76dc247ed4be294626

SHA256
ea19d7220ab8186afd2e4202edef17368aa2c380e8177bd45d96d98546b85c34

SHA512
99ac9831fff42e8a4a12cb1b66da3f6b86fce55c152e18f7f7a7ccc1654ad3aa51cd158651ea4ca8022403454fb522d7711e5c9810d17608b2723a00de12f700

Download Submit
C:\Users\Admin\AppData\Local\Temp\rkfc.exe

Filesize
141KB

MD5
7172eb5ac389046514443b4b567c4db0

SHA1
f291bc8e2aebe6d8b6d07722f4ef2e71881736bc

SHA256
3dc3e0f446d20e3337019d0e9f3cd8ca38153c730daf33d516af8cb24ecb1690

SHA512
b044347e75c57d83fbd12396cefefe0fd48f8c0ce59a6d8ddc88b2182f512491fc9e160e58842861df83bee1561fbfa7891e5081ace7413d50bcba4168e718c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
a79a57bbbecc50d6c574441b8d73b195

SHA1
d03228140e56cf040d953a946374fed031d03525

SHA256
c8df68da88a1156dc617f6c191d854f601072a204f99665b4e8a83057f2532ad

SHA512
5f9fcc73175173ca7085d4a718bf2a4546ed4710f62ad0efc1f03305a800205716dc08007ad36cf677a394140432c0c0190bb70824dd9be48022de64f0c25816

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
a79a57bbbecc50d6c574441b8d73b195

SHA1
d03228140e56cf040d953a946374fed031d03525

SHA256
c8df68da88a1156dc617f6c191d854f601072a204f99665b4e8a83057f2532ad

SHA512
5f9fcc73175173ca7085d4a718bf2a4546ed4710f62ad0efc1f03305a800205716dc08007ad36cf677a394140432c0c0190bb70824dd9be48022de64f0c25816

Download Submit
\Users\Admin\AppData\Local\Temp\rkfc.exe

Filesize
141KB

MD5
7172eb5ac389046514443b4b567c4db0

SHA1
f291bc8e2aebe6d8b6d07722f4ef2e71881736bc

SHA256
3dc3e0f446d20e3337019d0e9f3cd8ca38153c730daf33d516af8cb24ecb1690

SHA512
b044347e75c57d83fbd12396cefefe0fd48f8c0ce59a6d8ddc88b2182f512491fc9e160e58842861df83bee1561fbfa7891e5081ace7413d50bcba4168e718c2

Download Submit
memory/2716-20-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2716-18-0x0000000001230000-0x000000000125B000-memory.dmp

Filesize
172KB

Download
memory/2716-23-0x0000000001230000-0x000000000125B000-memory.dmp

Filesize
172KB

Download
memory/2716-29-0x0000000001230000-0x000000000125B000-memory.dmp

Filesize
172KB

Download
memory/2888-0-0x0000000000920000-0x000000000094B000-memory.dmp

Filesize
172KB

Download
memory/2888-19-0x0000000000920000-0x000000000094B000-memory.dmp

Filesize
172KB

Download
memory/2888-7-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/2888-1-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download