urelas | c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe
Size 101KB
Sample240310-a8vzmsgb5w
SHA256 c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1
MD5 498007c3828d1c75c2f7072f060f1372
SHA1 82a3b73611d05705d9632d35097adc21d13f8dea
SHA512 c4a43bd38296291fdbf09bfdd86a4f63d7d294660455ead2e416e40b346be9ce88a057208d62bb57cc80ff88f2243767b206f5647f19f2982c9de14e6177558e
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH7HU:SSf9yk+U2V63XAFSrRKBHDU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

resource	yara_rule
behavioral2/memory/4780-0-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023244-6.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1692-15-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4780-17-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1692-20-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1692-22-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1692-28-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe

Executes dropped EXE 1 IoCs

pid	Process
1692	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1692	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	94
PID 4780 wrote to memory of 1692	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	94
PID 4780 wrote to memory of 1692	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	94
PID 4780 wrote to memory of 1700	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	95
PID 4780 wrote to memory of 1700	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	95
PID 4780 wrote to memory of 1700	4780	c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe	95

C:\Users\Admin\AppData\Local\Temp\c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe
"C:\Users\Admin\AppData\Local\Temp\c2d51082918242a12703c1cb424f0848458831253571fd03f4c4ff642afac2a1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
MD5 d8c69e006046149f40585fb3e1bfafb4
SHA1 97073fb1d116248dbecd009e4bf873ab45c6c2da
SHA512 b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 101KB
SHA256 f24f848043ea78d12434ed5bd2ddf3548d745d2c80a3d15f9a54b6f41587ab64
MD5 64f779fbb2b159186fa11533c404565c
SHA1 745466791c0f59e01f3e0b86685ac54ab7e41475
SHA512 af121e243e983e1bc4bcf4ed183c751dce21160caa63ab50deaea03b7af71430a4c22d7d5eecc1e5ed191c29f1d0f2240aff039836867272850a99f161dac399
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH7H0:SSf9yk+U2V63XAFSrRKBHD0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 35d35c3c81855bd85e6610285edf6d4cab6565e71d05c02ae8e4ac782e38a4d1
MD5 60246483c5977390a02af2cf24b0b3dc
SHA1 30220344459ca0a1cc0384815e572338cf9eca8e
SHA512 b2aa0a07ce5859bbb09694b10303f6caca45453e95c6b7128dfe36f1caa2d25e82979a259c2739d348ce842089a842497d20987c45bc5de5a5af0b2fe18d8f63
MD5 SHA1 SHA512

Submit Download

memory/1692-15-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1692-20-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1692-22-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1692-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4780-17-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads