urelas | 8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
Size

92KB
MD5

01fd4daa9eaf6bcc9cfaa37efa2f3430
SHA1

fddfd69cb7fdec778088ed568656103c62c3e85f
SHA256

8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94
SHA512

fcdc4890fd25dd58648a0d6602ca130f2c61efcce12f31377b3cb2955758491e7fd1fbae5b4a1a060fffe9028b2568a443450abe189529b3bd7ba4de9350ab87
SSDEEP

768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4Us:OVNSf7hyk+I6412V6PMqAax80XAFSrR+

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2196	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1384	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 1384	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	28
PID 1252 wrote to memory of 2196	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	29
PID 1252 wrote to memory of 2196	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	29
PID 1252 wrote to memory of 2196	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	29
PID 1252 wrote to memory of 2196	1252	01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d8c69e006046149f40585fb3e1bfafb4

SHA1
97073fb1d116248dbecd009e4bf873ab45c6c2da

SHA256
df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

SHA512
b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
304B

MD5
9b6e321710b30ad900aa92e5cb30d191

SHA1
e09bf7d2dc2af6b1ac030c9853a9639582c26888

SHA256
84fd1df0d46564fafc29f3ed7b9e1fdf0f02dbbdd80166c1a713c4519c114f28

SHA512
42d07d99d6d6e80bb85a7e09b5eb374b727182af1ee44b7893367d4406eb751b61a28ad2591be9f0cb455dd6849a1e90f3b20ef210079be89eb951e4aba31a7e

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
92KB

MD5
f5d943978595a5176fe6aee3aca57157

SHA1
88096c8297ec5101fe1c06c464f03fe3275f778d

SHA256
af3d47c96fbc712ba82df328a7651419337703ca4965eed1e544658b686c672b

SHA512
f3aeb079ac8225af6717803714f66050a72f73601b5108777c524f3182a36108cfd030be527d6f420e73cc24949c236070b3a1d4ff0b5561bf1d86594259078c

Download Submit
memory/1252-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1252-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1384-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1384-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1384-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1384-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download