urelas | aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac

Analysis

max time kernel
154s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe
Size 178KB
Sample240310-ame2aseh74
SHA256 aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac
MD5 6b5c66bd484faba116735a21c06071b9
SHA1 a8cd57baa041f738a20d4781763582cf836d7e0a
SHA512 4a19d6e59ebce0e22beaece66be730c35af8e9e18639c85da8fe611e91ef1dc4a3f4f1c16328c7e4fb40377aa4adc81dc9eb75a246a7b9b07f080363b95e1bfe
SSDEEP 1536:JP02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pWDW:SuYndSW7gILCLIPtqVu5DqpxhzWDW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	opert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3964	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	99
PID 1444 wrote to memory of 3964	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	99
PID 1444 wrote to memory of 3964	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	99
PID 1444 wrote to memory of 3628	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	100
PID 1444 wrote to memory of 3628	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	100
PID 1444 wrote to memory of 3628	1444	aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe	100

C:\Users\Admin\AppData\Local\Temp\aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe
"C:\Users\Admin\AppData\Local\Temp\aa4dc9f3feda66b7688ab7899a4bc195a5d6dd0ae8fcea9936acf517dc650dac.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
MD5 SHA1 SHA512

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 178KB
SHA256 ff93b12b3d7a51d2eadbb1d29b5c90c35d7df0c5aa24439bc9145b4585145b26
MD5 fe4ec669fb5c81824118368d8dfb4e1a
SHA1 c049892c4e7162029414f91c8bf716689996d98a
SHA512 02233057d0354b0adf1f8b6d13651809235efb3c8c18b093a2075c989789590bf100be8ae6ad91fc7c0024b55ddfd74c622e1a33961b7b893f33bbe0fed81bc5
SSDEEP 1536:JP02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pWDL:SuYndSW7gILCLIPtqVu5DqpxhzWDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 c65d573d23b2cc38d26d934fe4ef56f6427e68ff6276c96ae8148b45ed33bf70
MD5 0eaa0c80fbf86531551b98c05f23ca89
SHA1 f2cc0fbdb8b884bec477789ddfbfabc58a41d38b
SHA512 187c66df87eb61fd964c9df00c2e8cbd848ddddbcccd2bbae6f084164a523e2584e84e7abc38e519a3ae6fc51f902d933cc4fbfd1feeb9e87d6eec39c230b74c
MD5 SHA1 SHA512

Submit Download

memory/1444-0-0x0000000000B70000-0x0000000000B9F000-memory.dmp

Download

memory/1444-14-0x0000000000B70000-0x0000000000B9F000-memory.dmp

Download

memory/3964-10-0x0000000000B80000-0x0000000000BAF000-memory.dmp

Download

memory/3964-17-0x0000000000B80000-0x0000000000BAF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads