urelas | c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe
Size 101KB
Sample240310-a8vzmsgb5w
SHA256 c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1
MD5 498007c3828d1c75c2f7072f060f1372
SHA1 82a3b73611d05705d9632d35097adc21d13f8dea
SHA512 c4a43bd38296291fdbf09bfdd86a4f63d7d294660455ead2e416e40b346be9ce88a057208d62bb57cc80ff88f2243767b206f5647f19f2982c9de14e6177558e
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH7HU:SSf9yk+U2V63XAFSrRKBHDU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000e000000012304-4.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2100-9-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1740-17-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2100-20-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2100-22-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2100-28-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
3008	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2100	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 2100	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	28
PID 1740 wrote to memory of 3008	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	29
PID 1740 wrote to memory of 3008	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	29
PID 1740 wrote to memory of 3008	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	29
PID 1740 wrote to memory of 3008	1740	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	29

C:\Users\Admin\AppData\Local\Temp\c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe
"C:\Users\Admin\AppData\Local\Temp\c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
MD5 d8c69e006046149f40585fb3e1bfafb4
SHA1 97073fb1d116248dbecd009e4bf873ab45c6c2da
SHA512 b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 35d35c3c81855bd85e6610285edf6d4cab6565e71d05c02ae8e4ac782e38a4d1
MD5 60246483c5977390a02af2cf24b0b3dc
SHA1 30220344459ca0a1cc0384815e572338cf9eca8e
SHA512 b2aa0a07ce5859bbb09694b10303f6caca45453e95c6b7128dfe36f1caa2d25e82979a259c2739d348ce842089a842497d20987c45bc5de5a5af0b2fe18d8f63
MD5 SHA1 SHA512

Submit Download

huter.exe

Path \Users\Admin\AppData\Local\Temp\huter.exe
Size 101KB
SHA256 4974dd74b0d98bbbeed16568bb1113fc295ba50d46b00a17db9cd81c83b4c5c5
MD5 3887aff8f6588dd45d1b3f7c7ce34a92
SHA1 88855d640f29891188967040c81925ef91474f55
SHA512 7a04d04ba56fd87df772dff788485d7e9fb44b735decfe3b3422be8213d466d738151f03a97da93ce03f7aaef36c010223be2e405874b1f1b5d906381d87f0f8
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH7Ho:SSf9yk+U2V63XAFSrRKBHDo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1740-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1740-17-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2100-9-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2100-20-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2100-22-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/2100-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads