urelas | 34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe
Size 101KB
Sample240310-y65ytsbc84
SHA256 34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19
MD5 9ebd35221e5cf4b1148630d954daab15
SHA1 0e4902db1979fa693df9442814c990d85ea13ab0
SHA512 663e8c43947ca928bb60b170aabde1498ea2b420ced890e7dea79fc5454da4bc7bfcd471c8534102f2cf17ec8778f17bb905b7822954e7c43e9e589b584e6c79
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH/bdF2L:SSf9yk+U2V63XAFSrRKBHTiL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

resource	yara_rule
behavioral2/memory/4856-0-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000a000000023117-6.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-14-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4856-17-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-20-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-22-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-28-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe

Executes dropped EXE 1 IoCs

pid	Process
4488	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4488	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	92
PID 4856 wrote to memory of 4488	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	92
PID 4856 wrote to memory of 4488	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	92
PID 4856 wrote to memory of 4508	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	93
PID 4856 wrote to memory of 4508	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	93
PID 4856 wrote to memory of 4508	4856	34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe	93

C:\Users\Admin\AppData\Local\Temp\34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe
"C:\Users\Admin\AppData\Local\Temp\34fa041f2f40697b1645b707b77fd408482979cac99381a6927244b4425acb19.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
MD5 d8c69e006046149f40585fb3e1bfafb4
SHA1 97073fb1d116248dbecd009e4bf873ab45c6c2da
SHA512 b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 101KB
SHA256 c64ddb037c1cdad6d56e384d2567fc4c2534f3e88b230a756fda088374566c28
MD5 6899e71efc96408f81dacaddb78f7484
SHA1 28cfccefe0d845bc42ef937c48a691d0b20f6181
SHA512 e478cf0539bba50c0c57aa037aa0eb5ce3be5568dbb2aca1350d1c1ce4cc0d5a2e34325cb95bd16f8feed8e2fe0a7f995190019516d0dd71565ad7e56bc7f4e5
SSDEEP 1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH/bdF2o:SSf9yk+U2V63XAFSrRKBHTio
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 66b8eb1620fd990bbe560fb0f19e8846f234b67400c0e36b961801adbba2f291
MD5 5c990f219f43ae6f7bc6782e2a4de2c9
SHA1 74e0e96cde718d7731195bd36e484f38f72b1863
SHA512 57c30cedc98ce13ba18a075bc18fc4b70a9ac922ebb5f03d8d2ff2fe33a380ffb5b43d48defc534f522c33391e009ad7ce12d4c9775d1f0ab71086062c7e2d3b
MD5 SHA1 SHA512

Submit Download

memory/4488-14-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4488-20-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4488-22-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4488-28-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4856-17-0x0000000000400000-0x0000000000438000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads