urelas | 6f65c1b0994a939a441001d9424b6029665413bd2097ab568aba80d6caa9e15a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe
Size

199KB
MD5

6c642afbeb196f365726a86ac3faf5d0
SHA1

ff699e388391541d0f5473a27543d40158f73645
SHA256

6f65c1b0994a939a441001d9424b6029665413bd2097ab568aba80d6caa9e15a
SHA512

71669aea375c8faa9946255e801aa78c4a79e66fcf9ca42b8ac049248423188987642b70b03ddd8ca92c0e84371f01569dad555319ec3811f7d6fafa49e3286d
SSDEEP

3072:mOu4dvYP2VkKRCvSkOqoIXpGTq/tmdUHhULc4Gc:mOuyvYPGkKRaHXpG5do4D

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2776	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1292	Aisder.exe

Loads dropped DLL 1 IoCs

pid	Process
1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1292	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	28
PID 1636 wrote to memory of 1292	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	28
PID 1636 wrote to memory of 1292	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	28
PID 1636 wrote to memory of 1292	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	28
PID 1636 wrote to memory of 2776	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	30
PID 1636 wrote to memory of 2776	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	30
PID 1636 wrote to memory of 2776	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	30
PID 1636 wrote to memory of 2776	1636	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\Aisder.exe
  "C:\Users\Admin\AppData\Local\Temp\Aisder.exe"
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Aisder.exe

Filesize
199KB

MD5
cd23bc98133d2454994e03f0306f5c95

SHA1
de5d4adb8a4a137af16ca3badc55efd6fa13cefd

SHA256
4a161986df165c589aa107ee96871d55dc9e6dc57274c2e95af34dcd89e546b6

SHA512
4b3449ecc4f0bf78a3626a4d63d3b9bfa4f37b9ecaf8819e7b38a058ffb56337b18a2de7333b8709bf75f1464c2e3f932ece4cd3415985e9f6ca64bdd12fd817

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e593d24d1352151a91db6a6d5f242e9

SHA1
3aaa4401a4dad7905d79204a85d05fe96caca332

SHA256
8fd4fa811592462f28a25ef15247bdee4734c26ed6b5588c8c1e85399e827357

SHA512
2934e8653e308b2e73d71e87743e8281aac9553fb4f855a2b59f13e3c69d661bd5603e3a6bc7d243083499c1aec3a64bf988b1bca0784d6cb2485ba74bd14b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
d064eaccdcc57c2b96bb45dd421d021c

SHA1
6f68f69982bfad05c687a3b3cd0ae1ff5c267eb0

SHA256
89945ee9f824a4bacd2b73c908b794f37ec4e6ccaaac1358c195cb32bb366917

SHA512
cc1b70cd6f48532ab0a29b9f875a84ef96e146ba21f64e7eba79bb0b70e95f9d944e270814b90942b6ecf3cf64d396369c7affb015b8f61677d872da8bcaf7ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
d064eaccdcc57c2b96bb45dd421d021c

SHA1
6f68f69982bfad05c687a3b3cd0ae1ff5c267eb0

SHA256
89945ee9f824a4bacd2b73c908b794f37ec4e6ccaaac1358c195cb32bb366917

SHA512
cc1b70cd6f48532ab0a29b9f875a84ef96e146ba21f64e7eba79bb0b70e95f9d944e270814b90942b6ecf3cf64d396369c7affb015b8f61677d872da8bcaf7ff

Download Submit
\Users\Admin\AppData\Local\Temp\Aisder.exe

Filesize
199KB

MD5
cd23bc98133d2454994e03f0306f5c95

SHA1
de5d4adb8a4a137af16ca3badc55efd6fa13cefd

SHA256
4a161986df165c589aa107ee96871d55dc9e6dc57274c2e95af34dcd89e546b6

SHA512
4b3449ecc4f0bf78a3626a4d63d3b9bfa4f37b9ecaf8819e7b38a058ffb56337b18a2de7333b8709bf75f1464c2e3f932ece4cd3415985e9f6ca64bdd12fd817

Download Submit
memory/1292-18-0x00000000009B0000-0x00000000009E5000-memory.dmp

Filesize
212KB

Download
memory/1292-22-0x00000000009B0000-0x00000000009E5000-memory.dmp

Filesize
212KB

Download
memory/1292-23-0x00000000009B0000-0x00000000009E5000-memory.dmp

Filesize
212KB

Download
memory/1636-0-0x0000000000E50000-0x0000000000E85000-memory.dmp

Filesize
212KB

Download
memory/1636-17-0x0000000000E50000-0x0000000000E85000-memory.dmp

Filesize
212KB

Download
memory/1636-10-0x0000000000410000-0x0000000000445000-memory.dmp

Filesize
212KB

Download
memory/1636-21-0x0000000000410000-0x0000000000445000-memory.dmp

Filesize
212KB

Download