urelas | 690019240cab2c2a34a2da793bb384bd13ea2dceefc6608e74b36b2621c51507

Analysis

max time kernel
198s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.960a853009a4ca5b1363707f13512181_JC.exe
Size

174KB
MD5

960a853009a4ca5b1363707f13512181
SHA1

49f75ae83644fa8a2f091afcf7922e835caa5cc3
SHA256

690019240cab2c2a34a2da793bb384bd13ea2dceefc6608e74b36b2621c51507
SHA512

8cbf45c97aaca9b76f8f3e67bc8539f00ce3d5e92a5cb3e70bdd740092d0dd66802d99cc4b51f10b4a0df60d20d7aac795c65165d6c7e6a7025acd5656864b56
SSDEEP

1536:JP02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pvUND:SuYndSW7gILCLIPtqVu5DqpxhzvUND

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

121.88.5.184

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	NEAS.960a853009a4ca5b1363707f13512181_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4472	opert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4472	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	90
PID 2120 wrote to memory of 4472	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	90
PID 2120 wrote to memory of 4472	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	90
PID 2120 wrote to memory of 2856	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	91
PID 2120 wrote to memory of 2856	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	91
PID 2120 wrote to memory of 2856	2120	NEAS.960a853009a4ca5b1363707f13512181_JC.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.960a853009a4ca5b1363707f13512181_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.960a853009a4ca5b1363707f13512181_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6735bbe93159782090eb9c49dde676c6

SHA1
6edec7009f27d90d36081a9d4a05fc6e6bde28e2

SHA256
f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217

SHA512
8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
175KB

MD5
fdaac31105828f530835293a6fe3176c

SHA1
c10a97daafcb58fe617b6b5ca67b929420dcedcb

SHA256
f08deae8210d752a662a8b428f3099b22c8aa93f58ecc8567407a52ffa0a8c22

SHA512
51871642702ac963809ed0694191ca36766a1f7421188e79ac0145c07c3368a804bc4bb7d51efd975a65a00dd472bbee2de02b49ebd800b9774bcc8433c05c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
175KB

MD5
fdaac31105828f530835293a6fe3176c

SHA1
c10a97daafcb58fe617b6b5ca67b929420dcedcb

SHA256
f08deae8210d752a662a8b428f3099b22c8aa93f58ecc8567407a52ffa0a8c22

SHA512
51871642702ac963809ed0694191ca36766a1f7421188e79ac0145c07c3368a804bc4bb7d51efd975a65a00dd472bbee2de02b49ebd800b9774bcc8433c05c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
175KB

MD5
fdaac31105828f530835293a6fe3176c

SHA1
c10a97daafcb58fe617b6b5ca67b929420dcedcb

SHA256
f08deae8210d752a662a8b428f3099b22c8aa93f58ecc8567407a52ffa0a8c22

SHA512
51871642702ac963809ed0694191ca36766a1f7421188e79ac0145c07c3368a804bc4bb7d51efd975a65a00dd472bbee2de02b49ebd800b9774bcc8433c05c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
78981479ad1e5ff2b0e370c72f54b99d

SHA1
22757a60c50303783fd9bed31bc0b50d0c8b4eb7

SHA256
86fc96b3384cf16c462bb38193c753152474f51d9a773bb52748832fb2850c68

SHA512
60cdc9992e7d9c06ca54e13ecacb04c660e756a4bf9ed02d21baf99effa4b0a3798399cc691b9fbb53103f17f1c8628f263ba68c03993eaba7a10b3d57afbe70

Download Submit
memory/2120-0-0x00000000007A0000-0x00000000007CF000-memory.dmp

Filesize
188KB

Download
memory/2120-14-0x00000000007A0000-0x00000000007CF000-memory.dmp

Filesize
188KB

Download
memory/4472-9-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download
memory/4472-17-0x0000000000370000-0x000000000039F000-memory.dmp

Filesize
188KB

Download