urelas | 352e47d9fe7b3b74e35e0f277f3403168bc9aaa9ff65349c54340c3320968929

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0fe9bd0c8b53673069794cdfe3c3e55.exe
Size 348KB
Sample240311-tdsetaag99
SHA256 352e47d9fe7b3b74e35e0f277f3403168bc9aaa9ff65349c54340c3320968929
MD5 c0fe9bd0c8b53673069794cdfe3c3e55
SHA1 c2fb7d917fb9a55bcf76d23b2718bf869f435401
SHA512 82e6b1b49e78ffbeb0ab8a117e07916bacc3c1282c9c1435de860905f6a2ae7953159ed4b20eb60d8359eb9c30dae82075576996b8092c37ec43cf9255cd9a6e
SSDEEP 6144:E/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZU:Y0G5obGGraOpUWlpX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
1124	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1692	rehex.exe
2704	xuqucu.exe
2328	bumuk.exe

Loads dropped DLL 6 IoCs

pid	Process
2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe
2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe
1692	rehex.exe
1692	rehex.exe
2704	xuqucu.exe
2704	xuqucu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe
2328	bumuk.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1692	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	28
PID 2004 wrote to memory of 1692	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	28
PID 2004 wrote to memory of 1692	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	28
PID 2004 wrote to memory of 1692	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	28
PID 2004 wrote to memory of 1124	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	29
PID 2004 wrote to memory of 1124	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	29
PID 2004 wrote to memory of 1124	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	29
PID 2004 wrote to memory of 1124	2004	c0fe9bd0c8b53673069794cdfe3c3e55.exe	29
PID 1692 wrote to memory of 2704	1692	rehex.exe	31
PID 1692 wrote to memory of 2704	1692	rehex.exe	31
PID 1692 wrote to memory of 2704	1692	rehex.exe	31
PID 1692 wrote to memory of 2704	1692	rehex.exe	31
PID 2704 wrote to memory of 2328	2704	xuqucu.exe	34
PID 2704 wrote to memory of 2328	2704	xuqucu.exe	34
PID 2704 wrote to memory of 2328	2704	xuqucu.exe	34
PID 2704 wrote to memory of 2328	2704	xuqucu.exe	34
PID 2704 wrote to memory of 2628	2704	xuqucu.exe	35
PID 2704 wrote to memory of 2628	2704	xuqucu.exe	35
PID 2704 wrote to memory of 2628	2704	xuqucu.exe	35
PID 2704 wrote to memory of 2628	2704	xuqucu.exe	35

C:\Users\Admin\AppData\Local\Temp\c0fe9bd0c8b53673069794cdfe3c3e55.exe
"C:\Users\Admin\AppData\Local\Temp\c0fe9bd0c8b53673069794cdfe3c3e55.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\rehex.exe
  "C:\Users\Admin\AppData\Local\Temp\rehex.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\xuqucu.exe
    "C:\Users\Admin\AppData\Local\Temp\xuqucu.exe" OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\bumuk.exe
      "C:\Users\Admin\AppData\Local\Temp\bumuk.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Deletes itself
  PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 4443d234dbc1339b4011bbababa621a495d1ad39d123627571c789c32e89b33f
MD5 c558cc94c291239824b98445b1090393
SHA1 91dd6e332f3838c17b9ee04ce2ca94aecd2bcf36
SHA512 d13568a001c953cf892ab6d585dffd70501cf407adc21baee458a54c181d913565f88150a2144080ae9976698fdabc9c3d38c73e84d1446fc03054dc36918fcb
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 276B
SHA256 e2bd1f0252dc794b8dd05ed4dda5de8f17785ee4499afaa980fb862c66673198
MD5 ac20e65e3e460f539a20eafbd8729fc4
SHA1 7d66f424be2b88374945ffda8659b153e53b5955
SHA512 f3b2b6799e193f4ee835c1a18d814249a715a6e7be15550529eb9562a20cfb390a0298ad19b1ce05436666e5d476d60ab4656c4ca2c8dd6321a15e8d96738efa
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 0bd870b65af1ab00503fb37eb1c3609f48df1a84eafbd69cd71eaf96aa17e98a
MD5 a6036307532f3d61ffe666bb783945a3
SHA1 ec0b36f2fda989510b4ecdf6477b9fb74070c315
SHA512 65bbb311ddb5bf2c8bdf19f270d4173968280b64faa2111a792bccf858dd11423461b338b38b28d851d533f2661810a586fa72e966ae4b9a8c5c7bfb7247c400
MD5 SHA1 SHA512

Submit Download

bumuk.exe

Path \Users\Admin\AppData\Local\Temp\bumuk.exe
Size 115KB
SHA256 15a757596965e490405ef0e2b92afeafadeda8e5d8ba92fc5a5935437c2a6bf4
MD5 ab3921c57bfb22a1235daa1e906691c0
SHA1 bd02e863ca64ca82b9f240c85e9c1afa3e6fa616
SHA512 fe9fe013d5567d6268225c1306fd403c368b47c251bd50765a1858054cdd79e038df7de08c9a8b50be1ca073770458fec93610caf0eefb32683036f20672032e
SSDEEP 1536:jL9ubrni7nDh0ESGftf9qAv1O5dyq0P1Lp6x8pmHg4Ch4Am9L:jpinaWESKtkYkFI65E6Aml
MD5 SHA1 SHA512 SSDEEP

Submit Download

rehex.exe

Path \Users\Admin\AppData\Local\Temp\rehex.exe
Size 348KB
SHA256 8a0486b40b775d7132c4121225ffe1b837fbbea3df1cc210040bdf4fd135e61a
MD5 003ca60b382860836dcbcea64894fae6
SHA1 aab378faa9a770f3db2e7872485b1a47b10f4242
SHA512 5487d7528abd53db444654aa6e543b7cbf38717f86c62ac1c3026e4076e5c4ce5c8e79294203da045b2c0f4412ae8587af2feba59648c821a5ed3dfe154a66e4
SSDEEP 6144:E/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZE:Y0G5obGGraOpUWlpp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1692-22-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1692-33-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2004-6-0x0000000002B00000-0x0000000002B5C000-memory.dmp

Download

memory/2004-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2004-19-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2328-62-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-65-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-64-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-57-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-63-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-60-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2328-61-0x0000000001030000-0x00000000010B2000-memory.dmp

Download

memory/2704-36-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2704-55-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2704-56-0x0000000003120000-0x00000000031A2000-memory.dmp

Download

memory/2704-35-0x0000000000400000-0x000000000045C000-memory.dmp

Download