urelas | fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe
Size 178KB
Sample240316-b2h7yagg61
SHA256 fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1
MD5 b5cf7cd7b6e663854114dfee85325f20
SHA1 d6ccf6ecb3d7f532e060a78a231e644c1aa8484b
SHA512 fad3313d92410e03f3eb83110206cecf4f952770b839c4817834e89dd7cd16267aece5d3883faab7096822584cb9b83265bf6e95b04082d3ea9d2facbcc195d8
SSDEEP 1536:JP02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pWk:SuYndSW7gILCLIPtqVu5DqpxhzWk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe

Executes dropped EXE 1 IoCs

pid	Process
4004	opert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4004	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	92
PID 2364 wrote to memory of 4004	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	92
PID 2364 wrote to memory of 4004	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	92
PID 2364 wrote to memory of 4920	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	93
PID 2364 wrote to memory of 4920	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	93
PID 2364 wrote to memory of 4920	2364	fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe	93

C:\Users\Admin\AppData\Local\Temp\fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe
"C:\Users\Admin\AppData\Local\Temp\fd4aebbe15b9c6006252a5ef13e9487f6ffc6480c87fec1bb52ed7a66924e5b1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
MD5 SHA1 SHA512

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 178KB
SHA256 39aeac64377d58b0d5f6fe8b1ab42b6efb72c1718ed465435bae34ccb05d2226
MD5 60f4c53c1be56feeca2508237167aa5c
SHA1 b7ccb7a6c95e05ef4c72c5ac89bdf8a1effc35a9
SHA512 23479f3cbd038393a41a5c0eab6790c19a8125443c2ace36fbb2d9717f4d3eb330f462eba361148e0622b7512b5be0162ef85eed790970e340054aefac18576a
SSDEEP 1536:JP02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pWE:SuYndSW7gILCLIPtqVu5DqpxhzWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 4e6c8726b4de59a53ebd2d4936028bbfea56139dcc84367349bd3017116b0b97
MD5 ced5d6cb44316056cbcff2494585f5a1
SHA1 5d5b37f22d07baf91abc7dcfc550d3b407bb9c16
SHA512 05bcb9d78e55a377a94ff977ae043af43a554d6c0a48544150e5c71a4ab2361a88134e6fdd2d134210f7b6a3e969fab2abba78e03f6c035fe3adf1571b8fdf0f
MD5 SHA1 SHA512

Submit Download

memory/2364-0-0x0000000000360000-0x000000000038F000-memory.dmp

Download

memory/2364-14-0x0000000000360000-0x000000000038F000-memory.dmp

Download

memory/4004-10-0x0000000000200000-0x000000000022F000-memory.dmp

Download

memory/4004-17-0x0000000000200000-0x000000000022F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads