urelas | 6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9

Analysis

max time kernel
144s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe
Size 174KB
Sample240309-2sefhada87
SHA256 6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9
MD5 77f00249908cb580e610e1652a21c81f
SHA1 287fc7d0b15255e237c5e9a10159e4033f422152
SHA512 df5650abf743f91256d499c972b3fe70b8ebd8e865fd196efed218c968c277cda9563b54978d7a0707242ffafda8fc15e9fcc299cf9fabf2d87d6578dd0a8b81
SSDEEP 1536:eADA0Wbt1931D2P7BWLQ4zR4LUKMcPHFE3HP/GTW65CGEgvpxyTf5ww:eADA0Wc7UJ6LZMaHLW65DE8pxWqw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe

Executes dropped EXE 1 IoCs

pid	Process
3592	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3592	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	92
PID 4640 wrote to memory of 3592	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	92
PID 4640 wrote to memory of 3592	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	92
PID 4640 wrote to memory of 3808	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	93
PID 4640 wrote to memory of 3808	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	93
PID 4640 wrote to memory of 3808	4640	6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe	93

C:\Users\Admin\AppData\Local\Temp\6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe
"C:\Users\Admin\AppData\Local\Temp\6909bd486794465b9c5a6c8b1f602708aaa32687b18b3dbfbde3b9a21fa8b6e9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 53c25f3ea9f537bb7d5accae21cbc5c9ef83e4bdf52143201ab08b69403b489c
MD5 e9bde5b44e2cc18d88ff2ee2dbc7081c
SHA1 b2eba2136f52d53ff3f60541bc79e7b217d0b268
SHA512 573357570a89779fc2984dcc70639460bc8d0cfc6d3a0a37d0623a5804630e804b34671b0f98765b9f7a68b04aa550ffbfd9ca69f6157cff1c826466943bfc8c
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 174KB
SHA256 239b05dd2d70d8953de132f1a05a4d38e9c00db601bbdfe875021f03d3582a4f
MD5 288d0b44b8a86b12ff852b7063cc10a6
SHA1 13652588be55cf223d989f34d5ee901e40ef7a74
SHA512 d10a7745b2656ab03418f12fdf9b479c5edf02cd576e64a63eb2458d645fdc53978b13f6106bb9b1b80bf26d7f789ffbd5889bd99fd63087047e17317ab70c29
SSDEEP 1536:eADA0Wbt1931D2P7BWLQ4zR4LUKMcPHFE3HP/GTW65CGEgvpxyTf5wQ:eADA0Wc7UJ6LZMaHLW65DE8pxWqQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 28786a6238d672cc20e341fc3ee4837ef7b6081709ff5db0825ed8bd0ee5da55
MD5 9c4cb210b087dc9a702bd1d5ef290538
SHA1 b7617bd74bad8814c6ddb3b83467f977a24adfe3
SHA512 7f105e9dceb9e78ed6297a8eca78ab6ab848c1dcb8986d82f347abb33c1cd5b4027c0c2c4f5d9291f1477731130b36c2683b662bd7eb585b5180d94ebddcf2d6
MD5 SHA1 SHA512

Submit Download

memory/3592-12-0x0000000001000000-0x0000000001030000-memory.dmp

Download

memory/3592-17-0x0000000001000000-0x0000000001030000-memory.dmp

Download

memory/4640-0-0x0000000000060000-0x0000000000090000-memory.dmp

Download

memory/4640-14-0x0000000000060000-0x0000000000090000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads