urelas | 8ba61061e2d0eafdb65f9b48746b225b97a08aa57c01999e9f7bafb320bcdc0c

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe
Size

176KB
MD5

8bd4ccc2173cf85bc191a7f084363960
SHA1

900004717293acb7822fb304bc67fb3950139daf
SHA256

8ba61061e2d0eafdb65f9b48746b225b97a08aa57c01999e9f7bafb320bcdc0c
SHA512

d430eeffe104365c1598d8a8b728b187c0908908fcc12713c5c2417dfdb9883da95befedb5c987adef2412f69e00072e3b6433af70d31bca9da1289d00e88956
SSDEEP

1536:Jv+x0V7eqzdYntSfGx+nAL2PdIkDNEnLAE0UtQgNMy3mvTtdK0vu5zypEh/tQX:IyVnYntSzWxnLj0OQg0tcau5zypEhFQX

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

121.88.5.184

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	opert.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2772	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	28
PID 2960 wrote to memory of 2772	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	28
PID 2960 wrote to memory of 2772	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	28
PID 2960 wrote to memory of 2772	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	28
PID 2960 wrote to memory of 2620	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	29
PID 2960 wrote to memory of 2620	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	29
PID 2960 wrote to memory of 2620	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	29
PID 2960 wrote to memory of 2620	2960	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6735bbe93159782090eb9c49dde676c6

SHA1
6edec7009f27d90d36081a9d4a05fc6e6bde28e2

SHA256
f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217

SHA512
8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
176KB

MD5
0b4c0a6d947dbc6d038e84686456d789

SHA1
68ebb00638c3e93d4cfb7c92a08b7d62cd0178c6

SHA256
3fae3c6c6746e364e151df2915d8578452852d641b7f8847b264ad0f66fd755f

SHA512
ee345e1819cc5d478ed8a7cc500e81d3790315576debaabe662dbb18e22ab84a3a4c3a5ba3d6d75f40455ad73a889267b68803673c9dfa1120e4d2053a041960

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
b877009d95c362b63eda3d6688651ddf

SHA1
8b9ad34466a9143dffae105674072ef16f2b3ca0

SHA256
838b49b58bf63eb421198afbb512449da2c6ee1e6b51dc4dee557634dbb24f04

SHA512
ce3137c1e7fef3db631273be63486501a6e44b3560b379aa88b301ec5a024e7957103cd5d1632da3192252fc92506f8f44d7c4b14ae678d446dc4fb628e05d97

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
b877009d95c362b63eda3d6688651ddf

SHA1
8b9ad34466a9143dffae105674072ef16f2b3ca0

SHA256
838b49b58bf63eb421198afbb512449da2c6ee1e6b51dc4dee557634dbb24f04

SHA512
ce3137c1e7fef3db631273be63486501a6e44b3560b379aa88b301ec5a024e7957103cd5d1632da3192252fc92506f8f44d7c4b14ae678d446dc4fb628e05d97

Download Submit
\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
176KB

MD5
0b4c0a6d947dbc6d038e84686456d789

SHA1
68ebb00638c3e93d4cfb7c92a08b7d62cd0178c6

SHA256
3fae3c6c6746e364e151df2915d8578452852d641b7f8847b264ad0f66fd755f

SHA512
ee345e1819cc5d478ed8a7cc500e81d3790315576debaabe662dbb18e22ab84a3a4c3a5ba3d6d75f40455ad73a889267b68803673c9dfa1120e4d2053a041960

Download Submit
memory/2772-17-0x0000000000FB0000-0x0000000000FDF000-memory.dmp

Filesize
188KB

Download
memory/2772-21-0x0000000000FB0000-0x0000000000FDF000-memory.dmp

Filesize
188KB

Download
memory/2960-0-0x0000000000920000-0x000000000094F000-memory.dmp

Filesize
188KB

Download
memory/2960-6-0x0000000001E50000-0x0000000001E7F000-memory.dmp

Filesize
188KB

Download
memory/2960-18-0x0000000000920000-0x000000000094F000-memory.dmp

Filesize
188KB

Download