urelas | 1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe
Size

101KB
MD5

9509ade2421452dcfbf0dfa30014731e
SHA1

88e70361d0c470e377498ad1aab64f8d4e18208d
SHA256

1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80
SHA512

40d8802912ccd33fa60643f1c6be23266195486ea40fef51da81148c4d8c4b84466b149d036969ec75fa8a0935b53e75f0e93fa08555ce0b046908847cbef79a
SSDEEP

1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRd4BH7Hlp1S:SSf9yk+U2V63XAFSrRKBHDlp1S

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

resource	yara_rule
behavioral2/memory/4836-0-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023442-6.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4484-14-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4836-17-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4484-20-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4484-22-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4484-28-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe

Executes dropped EXE 1 IoCs

pid	Process
4484	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4484	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	92
PID 4836 wrote to memory of 4484	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	92
PID 4836 wrote to memory of 4484	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	92
PID 4836 wrote to memory of 2916	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	93
PID 4836 wrote to memory of 2916	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	93
PID 4836 wrote to memory of 2916	4836	1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe	93

C:\Users\Admin\AppData\Local\Temp\1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe
"C:\Users\Admin\AppData\Local\Temp\1f769c3da14989744f5ce3e31c5e3cc580a0389400b9239e71d2b257f1200c80.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d8c69e006046149f40585fb3e1bfafb4

SHA1
97073fb1d116248dbecd009e4bf873ab45c6c2da

SHA256
df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

SHA512
b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
102KB

MD5
c941c579859eb3b452518e8b6ba4441e

SHA1
f6d393306d53d57a2cde3e525ac5da32a8f1d9ee

SHA256
fe6661424d2bb6983434adaaf1fce85bc7765cf93905fc34099f6556e8e01220

SHA512
287bee428a26aef7f5f3f4c4f50e8a921a9f5d8cfb23e3bc0664ffd162dac3c75223c2e827c0a5ac9ccb67960c8151ddf0973a424ebe3611e8906d650b53b0c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
0e371440b2341228c3978164187739d9

SHA1
f61013c286b4f5740a62a0ae64ea3fd6ed500e73

SHA256
78bf1b62ea12bfd4eba4b6a62cd0d1666db2aaad1f2a1b7df7ae255ef96bb6ea

SHA512
9ccd81d6eb282c59661b1e9643e3ab4e769a03fa3120c2d15adcd730e0d468cf4397b15d50e028787f8f0ced243c9ed83951c9f300ec182e25508817aca9c980

Download Submit
memory/4484-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4484-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4484-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4484-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4836-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4836-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download