urelas | eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe
Size 449KB
Sample240318-a964asdb4v
SHA256 eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3
MD5 15c593d81637dcf0061cf4020fc61a4d
SHA1 48842715f80fddd39f13d49c383611b04404db05
SHA512 52587e4fc2eed7886a77df2ed5c6d93be8b8fb2c91e7c0a56138fe2bb88412eab2b74e68c2d9da58773d9152d153020b3b5651781ae64c84532b0b1d78a0c5d3
SSDEEP 6144:YEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpjFBhclG:YMpASIcWYx2U6hAJQnDlG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2532	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1940	abhia.exe
2816	wozari.exe
2176	fojio.exe

Loads dropped DLL 3 IoCs

pid	Process
2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe
1940	abhia.exe
2816	wozari.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe
2176	fojio.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1940	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	28
PID 2084 wrote to memory of 1940	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	28
PID 2084 wrote to memory of 1940	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	28
PID 2084 wrote to memory of 1940	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	28
PID 2084 wrote to memory of 2532	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	29
PID 2084 wrote to memory of 2532	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	29
PID 2084 wrote to memory of 2532	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	29
PID 2084 wrote to memory of 2532	2084	eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe	29
PID 1940 wrote to memory of 2816	1940	abhia.exe	31
PID 1940 wrote to memory of 2816	1940	abhia.exe	31
PID 1940 wrote to memory of 2816	1940	abhia.exe	31
PID 1940 wrote to memory of 2816	1940	abhia.exe	31
PID 2816 wrote to memory of 2176	2816	wozari.exe	34
PID 2816 wrote to memory of 2176	2816	wozari.exe	34
PID 2816 wrote to memory of 2176	2816	wozari.exe	34
PID 2816 wrote to memory of 2176	2816	wozari.exe	34
PID 2816 wrote to memory of 1096	2816	wozari.exe	35
PID 2816 wrote to memory of 1096	2816	wozari.exe	35
PID 2816 wrote to memory of 1096	2816	wozari.exe	35
PID 2816 wrote to memory of 1096	2816	wozari.exe	35

C:\Users\Admin\AppData\Local\Temp\eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe
"C:\Users\Admin\AppData\Local\Temp\eafb7e8e9afedd85d5c54cd3cada915d748a1a755f1761c170d4814c8c4f50d3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\abhia.exe
  "C:\Users\Admin\AppData\Local\Temp\abhia.exe" hi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\wozari.exe
    "C:\Users\Admin\AppData\Local\Temp\wozari.exe" OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\fojio.exe
      "C:\Users\Admin\AppData\Local\Temp\fojio.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:1096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Deletes itself
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 f186b3b7c20c05dc13a7b2759560003e4b332ec8a2c5dcd38ef5c989e63f5bd7
MD5 22d883c9d05fd2ff2c2852ad94dd09f9
SHA1 0c00737049e1d77c7723e1a61601a4d63f6ce71b
SHA512 d8ff0cc0673dc6fc7e82cfd8e1bf2887784e86674bb96f16c768ddaabd1189150383374210cfb437e9cd15877009e2c995e288ddca8039b5bcf6f22accecb100
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 344f529cf992a410ec0b4e335ca5cf0015a0a0db2d1123911da55d552d76cf8c
MD5 bcaf11d14f16207f9af3306f920e0ed6
SHA1 c450dfffd35db519b3d465e631958a604fd8a4aa
SHA512 2903193feac185327c728a5a9442f7e96a28a8467656639db94a5beae1561cdd32c91009ac6f56606b0f8847afe2178cd3fb20956e22b4e143e1679cadb98220
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 49d6ee10e2a8696134d639c2f105a731e6fcf51bb293fbbf776fceecfed7a97b
MD5 5ff4316fa2f5e180d3ceccb9a8f4fec8
SHA1 0e16d674b1b6da90dbad66426976c48beebd48dc
SHA512 8fdec8c8f34e8a17296084275cdd92b91d97ee8f82144b5e000b21c1edc75df418ad816ca81084fe7006cdae24dd927f9a26a8c31252b5a8a4e582232bdd4b39
MD5 SHA1 SHA512

Submit Download

wozari.exe

Path C:\Users\Admin\AppData\Local\Temp\wozari.exe
Size 449KB
SHA256 46446911eaaf687097c3683c571dd3226d5461b5ec933b0e39d81a3746df0fb6
MD5 3ffd4985e74e86593660c32fb9daec10
SHA1 d40a86af192807483a780682d9da09f43780157c
SHA512 4f1a555e703734742d30250b85a75c10dfa3f86c653b20d50612cce6eaddd3764ff00171a3fcd879a55c04542982d05937f960eb6391a5dd856f947ac604a774
SSDEEP 6144:YEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpjFBhcl9:YMpASIcWYx2U6hAJQnDl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

abhia.exe

Path \Users\Admin\AppData\Local\Temp\abhia.exe
Size 449KB
SHA256 437bbf5dc6a086f22e90f36d3c79221c2613f6721579441fd4b46aa7630c1abc
MD5 b114cd6317d80662709099908c67bc76
SHA1 472779197bd660a1678955a8273a5642256b5e92
SHA512 5356c27c74062e0368daa5c7510d361b11b52472765ef9b0658826ae8c0e42cc7f40a9098844b589847673db8d0faa7c3d6e97e187abee127e36fc3fc8cc1140
SSDEEP 6144:YEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpjFBhcly:YMpASIcWYx2U6hAJQnDly
MD5 SHA1 SHA512 SSDEEP

Submit Download

fojio.exe

Path \Users\Admin\AppData\Local\Temp\fojio.exe
Size 223KB
SHA256 3b665b4c49c60ee271851633d2fd5f740a12f5d1d09cb46d0d4dd543b5895b83
MD5 64a074b3ccdd8a2dedbf7ec54d06c4d0
SHA1 bc3f0ec4828df9de7dde2ebc8b388ed3cf36ffcb
SHA512 35362dfab710ecd244dc07874e59ecfdf10867ac535b321d5bf2de70edeb8567d36dea0d3d22b192b7a5aa5dd6a0e9446dfcd696fa57ad721484967db474b151
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p31:unFhSIkAyDgjtS/FZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wozari.exe

Path \Users\Admin\AppData\Local\Temp\wozari.exe
Size 256KB
SHA256 4b7e0234e6ad51b227385e82497de19153d097340e8e9385518f2b0e0ce431f5
MD5 ab9c7bb20c4156000d708296dfa237bb
SHA1 c96d09f60a9711f781a65a6187a09b791988d339
SHA512 799ae1560ba0f0f06926b259e762e77b77ec6b8c4dee021668a0039c13f49b6b5652811092ac471eeff070a1ddf98f942ad0e5e77807979f08eb7168f51c98d2
SSDEEP 6144:YEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhq:YMpASIcWYx2U6hAJq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1940-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1940-25-0x0000000003090000-0x00000000030FE000-memory.dmp

Download

memory/2084-17-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2084-6-0x00000000025B0000-0x000000000261E000-memory.dmp

Download

memory/2084-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2176-45-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2176-47-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2176-51-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2176-52-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2176-53-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2176-54-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2176-55-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2176-56-0x00000000002C0000-0x0000000000360000-memory.dmp

Download

memory/2816-36-0x0000000002D60000-0x0000000002E00000-memory.dmp

Download

memory/2816-46-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2816-29-0x0000000000400000-0x000000000046E000-memory.dmp

Download