urelas | 3b519f8a0e98fcb6cb777b8ffc9627b2635d0175fb9da634d0dd0d6b7eb100ba

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe
Size

77KB
MD5

063638ed39f8c0eeebcd6e9615897640
SHA1

2eb066d5b25e9d79fde925338ea594f224031b36
SHA256

3b519f8a0e98fcb6cb777b8ffc9627b2635d0175fb9da634d0dd0d6b7eb100ba
SHA512

483ee441cf867787d4ea59d26901327a034633274ab664affae78b7913e120404c8fccd4ee53fdcbc56b83da759945b93a6583aceeee3809ce262b8ee5baad4e
SSDEEP

1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDE:9RkjWjK9ABpGzlaRQL

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3556	huter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4584-0-0x0000000000030000-0x0000000000061000-memory.dmp	upx
behavioral2/files/0x000a0000000232fc-6.dat	upx
behavioral2/memory/3556-13-0x00000000008D0000-0x0000000000901000-memory.dmp	upx
behavioral2/memory/4584-18-0x0000000000030000-0x0000000000061000-memory.dmp	upx
behavioral2/memory/3556-21-0x00000000008D0000-0x0000000000901000-memory.dmp	upx
behavioral2/memory/3556-23-0x00000000008D0000-0x0000000000901000-memory.dmp	upx
behavioral2/memory/3556-25-0x00000000008D0000-0x0000000000901000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3556	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	94
PID 4584 wrote to memory of 3556	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	94
PID 4584 wrote to memory of 3556	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	94
PID 4584 wrote to memory of 3732	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	95
PID 4584 wrote to memory of 3732	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	95
PID 4584 wrote to memory of 3732	4584	063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\063638ed39f8c0eeebcd6e9615897640_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55d2fdd1432483e3ba86ebeccfe130b6

SHA1
7280b14d708800fd15303b2caa8628a0fbd7aa08

SHA256
5cfd1668ec0e5f3b5f8d04e54091d6f173bede6e6f9bb418819fd550095139fb

SHA512
36fd81128552356672b52936699c5e6362268c8131857e778e02a6862600c4feb20d13063d5f838e0887cb5083c648d39fe07faffba18c26387760752f9dd1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
77KB

MD5
0b1f1a8a0a2aa8f0766bb935c324e3d7

SHA1
6c12770eb7169a89c2195582cd8ca9c8cc206a1f

SHA256
083cbb233407f0223f3ee5e44d78b03dca36d12a0348a40a9ac75b404a8c7de0

SHA512
cc1e29f969abe5d08f6f5de493647de121e5808f7df598cb417217b8d0a6514370e9fa66590999e17e81ff80becc6ba0afb23662d82b934df7ac64a52089fdba

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
304B

MD5
5550843f4dca20c83e5a53f7a733d950

SHA1
7efb7eaf928e9e663f6de0cbad36ad1ea996979b

SHA256
ced4cd4404f20dd46812b1a6947bd9c749403784f55b6aafb63263d67823cc6c

SHA512
d8353c56f4ce73bdaeaed173b2ab4fb839c4a4e6239cd4aac554c7a4f7528d5089eec301055c0dac9a3f4edc9b07e62473caaf716e0280a9ba8c2a140576be7d

Download Submit
memory/3556-13-0x00000000008D0000-0x0000000000901000-memory.dmp

Filesize
196KB

Download
memory/3556-21-0x00000000008D0000-0x0000000000901000-memory.dmp

Filesize
196KB

Download
memory/3556-23-0x00000000008D0000-0x0000000000901000-memory.dmp

Filesize
196KB

Download
memory/3556-25-0x00000000008D0000-0x0000000000901000-memory.dmp

Filesize
196KB

Download
memory/4584-0-0x0000000000030000-0x0000000000061000-memory.dmp

Filesize
196KB

Download
memory/4584-18-0x0000000000030000-0x0000000000061000-memory.dmp

Filesize
196KB

Download