urelas | 8ba61061e2d0eafdb65f9b48746b225b97a08aa57c01999e9f7bafb320bcdc0c

Analysis

max time kernel
128s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe
Size

176KB
MD5

8bd4ccc2173cf85bc191a7f084363960
SHA1

900004717293acb7822fb304bc67fb3950139daf
SHA256

8ba61061e2d0eafdb65f9b48746b225b97a08aa57c01999e9f7bafb320bcdc0c
SHA512

d430eeffe104365c1598d8a8b728b187c0908908fcc12713c5c2417dfdb9883da95befedb5c987adef2412f69e00072e3b6433af70d31bca9da1289d00e88956
SSDEEP

1536:Jv+x0V7eqzdYntSfGx+nAL2PdIkDNEnLAE0UtQgNMy3mvTtdK0vu5zypEh/tQX:IyVnYntSzWxnLj0OQg0tcau5zypEhFQX

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

121.88.5.184

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4496	opert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4496	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	91
PID 1220 wrote to memory of 4496	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	91
PID 1220 wrote to memory of 4496	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	91
PID 1220 wrote to memory of 3912	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	92
PID 1220 wrote to memory of 3912	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	92
PID 1220 wrote to memory of 3912	1220	NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8bd4ccc2173cf85bc191a7f084363960_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6735bbe93159782090eb9c49dde676c6

SHA1
6edec7009f27d90d36081a9d4a05fc6e6bde28e2

SHA256
f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217

SHA512
8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
176KB

MD5
53c7fa2e64887d70fd8577da65a1258f

SHA1
ea9b87910b13f17605560f10cb5e3fadab6fed4f

SHA256
fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

SHA512
9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
176KB

MD5
53c7fa2e64887d70fd8577da65a1258f

SHA1
ea9b87910b13f17605560f10cb5e3fadab6fed4f

SHA256
fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

SHA512
9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
176KB

MD5
53c7fa2e64887d70fd8577da65a1258f

SHA1
ea9b87910b13f17605560f10cb5e3fadab6fed4f

SHA256
fe390b6a77af1620a67bd1bc0361a85b08509400ccd0a42480a1839092261527

SHA512
9984f8ebbcfd3ecbee114ad070dc843a3a04b7fcd4721838e76cde6fe3ad950b1f53addba9d31a030929b931ba239d772f0443dc86393e9d70038c96b6f0ceac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
290B

MD5
b877009d95c362b63eda3d6688651ddf

SHA1
8b9ad34466a9143dffae105674072ef16f2b3ca0

SHA256
838b49b58bf63eb421198afbb512449da2c6ee1e6b51dc4dee557634dbb24f04

SHA512
ce3137c1e7fef3db631273be63486501a6e44b3560b379aa88b301ec5a024e7957103cd5d1632da3192252fc92506f8f44d7c4b14ae678d446dc4fb628e05d97

Download Submit
memory/1220-0-0x0000000000D30000-0x0000000000D5F000-memory.dmp

Filesize
188KB

Download
memory/1220-14-0x0000000000D30000-0x0000000000D5F000-memory.dmp

Filesize
188KB

Download
memory/4496-12-0x0000000000FA0000-0x0000000000FCF000-memory.dmp

Filesize
188KB

Download
memory/4496-17-0x0000000000FA0000-0x0000000000FCF000-memory.dmp

Filesize
188KB

Download