urelas | 6f65c1b0994a939a441001d9424b6029665413bd2097ab568aba80d6caa9e15a

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe
Size

199KB
MD5

6c642afbeb196f365726a86ac3faf5d0
SHA1

ff699e388391541d0f5473a27543d40158f73645
SHA256

6f65c1b0994a939a441001d9424b6029665413bd2097ab568aba80d6caa9e15a
SHA512

71669aea375c8faa9946255e801aa78c4a79e66fcf9ca42b8ac049248423188987642b70b03ddd8ca92c0e84371f01569dad555319ec3811f7d6fafa49e3286d
SSDEEP

3072:mOu4dvYP2VkKRCvSkOqoIXpGTq/tmdUHhULc4Gc:mOuyvYPGkKRaHXpG5do4D

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1320	Aisder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1320	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	89
PID 1072 wrote to memory of 1320	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	89
PID 1072 wrote to memory of 1320	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	89
PID 1072 wrote to memory of 1568	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	91
PID 1072 wrote to memory of 1568	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	91
PID 1072 wrote to memory of 1568	1072	NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6c642afbeb196f365726a86ac3faf5d0_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\Aisder.exe
  "C:\Users\Admin\AppData\Local\Temp\Aisder.exe"
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Aisder.exe

Filesize
199KB

MD5
3bf1164f186cdf627eda810319300cc2

SHA1
55b9b57e8ac328b0de4c9c513f3fbc72eee6a8ed

SHA256
6f8caf81a73e82149d1fc1989d40d13d8f0e88a5396ce6f44d28a7f6a4a29684

SHA512
bbd03f561a84e5921d7d10e2ead41c4c01e475d29aee41511cfab9bb65ac2a2ec86305db051900149c805aceea9a2bd4a0c5e07034fa95d361cc2d843178da5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aisder.exe

Filesize
199KB

MD5
3bf1164f186cdf627eda810319300cc2

SHA1
55b9b57e8ac328b0de4c9c513f3fbc72eee6a8ed

SHA256
6f8caf81a73e82149d1fc1989d40d13d8f0e88a5396ce6f44d28a7f6a4a29684

SHA512
bbd03f561a84e5921d7d10e2ead41c4c01e475d29aee41511cfab9bb65ac2a2ec86305db051900149c805aceea9a2bd4a0c5e07034fa95d361cc2d843178da5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aisder.exe

Filesize
199KB

MD5
3bf1164f186cdf627eda810319300cc2

SHA1
55b9b57e8ac328b0de4c9c513f3fbc72eee6a8ed

SHA256
6f8caf81a73e82149d1fc1989d40d13d8f0e88a5396ce6f44d28a7f6a4a29684

SHA512
bbd03f561a84e5921d7d10e2ead41c4c01e475d29aee41511cfab9bb65ac2a2ec86305db051900149c805aceea9a2bd4a0c5e07034fa95d361cc2d843178da5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e593d24d1352151a91db6a6d5f242e9

SHA1
3aaa4401a4dad7905d79204a85d05fe96caca332

SHA256
8fd4fa811592462f28a25ef15247bdee4734c26ed6b5588c8c1e85399e827357

SHA512
2934e8653e308b2e73d71e87743e8281aac9553fb4f855a2b59f13e3c69d661bd5603e3a6bc7d243083499c1aec3a64bf988b1bca0784d6cb2485ba74bd14b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
d064eaccdcc57c2b96bb45dd421d021c

SHA1
6f68f69982bfad05c687a3b3cd0ae1ff5c267eb0

SHA256
89945ee9f824a4bacd2b73c908b794f37ec4e6ccaaac1358c195cb32bb366917

SHA512
cc1b70cd6f48532ab0a29b9f875a84ef96e146ba21f64e7eba79bb0b70e95f9d944e270814b90942b6ecf3cf64d396369c7affb015b8f61677d872da8bcaf7ff

Download Submit
memory/1072-0-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/1072-14-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/1320-10-0x0000000000180000-0x00000000001B5000-memory.dmp

Filesize
212KB

Download
memory/1320-17-0x0000000000180000-0x00000000001B5000-memory.dmp

Filesize
212KB

Download
memory/1320-18-0x0000000000180000-0x00000000001B5000-memory.dmp

Filesize
212KB

Download