urelas | 00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe
Size 162KB
Sample240316-vm34cahb36
SHA256 00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68
MD5 3019d4d3a299f6742c7f1f8061578b0f
SHA1 251213e71586f5bd7899f8768906683f642dfadd
SHA512 035a087cd6329cd5d21b2f65d7a47bdd996a14be55e763e6da2cd5544f221c0dc1f8267afc21330639fa0d29fc3a68b53fb99c29a126bbe642fe8c48877d69e6
SSDEEP 1536:f79TuVtAd6xd6vEi0uxJ7WmjcbLCU+ZcKRtdBIw0vUQwYtMAo0gpy1m3V+oY0:fduV2vj+LocKle1Ft9o0gpem3hJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe

Executes dropped EXE 1 IoCs

pid	Process
3440	voic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3440	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	89
PID 3988 wrote to memory of 3440	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	89
PID 3988 wrote to memory of 3440	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	89
PID 3988 wrote to memory of 2640	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	90
PID 3988 wrote to memory of 2640	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	90
PID 3988 wrote to memory of 2640	3988	00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe	90

C:\Users\Admin\AppData\Local\Temp\00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe
"C:\Users\Admin\AppData\Local\Temp\00647c3b9107c89d403ae658fc036e7bd25f11d54c171b6a0c3cfec9ec688f68.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\voic.exe
  "C:\Users\Admin\AppData\Local\Temp\voic.exe"
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8c594ecc9db5fdaec007ba7c7c92c832bfe8ebed8a136f5ebd4fc56dae0defc8
MD5 cba20131333b6f5a6c9119191661ff8d
SHA1 1e709e11339276f1a219af27c636d8708c3cd495
SHA512 b2422fd4bec67962f689da75c095dc83f82790d859f2563c544accb02b30814b3db8c903e5196534d9dbf2f84132c7f8fd1c4e474678e761ce724ba3aac342d4
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 c790119aa4ea1e58964f6c6b3c7ae7b2c56895defd17e159f2862838e57e0fb3
MD5 8c6c134f7a608f533058d2fba03ecfe9
SHA1 fd9f645719da3d442372c38407cebc3bbcd8e513
SHA512 0b8ab1e52802717b6bf85d7dd0b0ebdc6df724e8837a9161c5aac28c573141aef3d2aacea42deaa29616ab3a28d9523008deddd78915a62b3318dae7ae963cea
MD5 SHA1 SHA512

Submit Download

voic.exe

Path C:\Users\Admin\AppData\Local\Temp\voic.exe
Size 162KB
SHA256 e7a922f97f38e60070f77be4df1e5fdb59b7e1cbad653c5211f81a29f7099a59
MD5 0ee3e7eb919b3cfcb077fe79181e7f73
SHA1 836dc91accf6a78af6383febab119666153c92ad
SHA512 2b9f1d296487f5c8c4134f3d669fee7015188619315b4dd91b5bbe5d103f85a615095181bb3f866f61df623bd8315e18c4e3a35665f3b78070916e8f80243440
SSDEEP 1536:f79TuVtAd6xd6vEi0uxJ7WmjcbLCU+ZcKRtdBIw0vUQwYtMAo0gpy1m3V+oYl:fduV2vj+LocKle1Ft9o0gpem3hU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3440-16-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3988-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3988-13-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads