urelas | fc19f4d7f09e4808a1cbd207febb01c8b4c585da3cc79adca9dd8eb688c4470b

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe
Size

94KB
MD5

b5cf372f74bc6253fcf901f1d5a6bd70
SHA1

0780a22b457fd33e69a66b6561c388da7db353d0
SHA256

fc19f4d7f09e4808a1cbd207febb01c8b4c585da3cc79adca9dd8eb688c4470b
SHA512

ecbcdc5607eef0e430148d38bb3e8ffed6096bdc315518a53551b0f20ad5d7af8d12b9a129d6a1b86d03a2270c25f1a880007b821a9ed56c0d0754a36d213bb2
SSDEEP

1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRmo:SSf9yk+U2V63XAFSrRmo

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

2184 huter.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2184	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe

description	pid	process	target process
PID 1560 wrote to memory of 2184	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	huter.exe
PID 1560 wrote to memory of 2184	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	huter.exe
PID 1560 wrote to memory of 2184	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	huter.exe
PID 1560 wrote to memory of 3188	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	cmd.exe
PID 1560 wrote to memory of 3188	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	cmd.exe
PID 1560 wrote to memory of 3188	1560	b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b5cf372f74bc6253fcf901f1d5a6bd70_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d8c69e006046149f40585fb3e1bfafb4

SHA1
97073fb1d116248dbecd009e4bf873ab45c6c2da

SHA256
df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

SHA512
b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
94KB

MD5
e49fd090dcc9485631789dc28b764945

SHA1
7b5b567b0ed8bbc67ffc9f03e39074bd52a4ecad

SHA256
017af7acf68e4404e80e70fa0f5f251a798ea4394df84efda871263ec5698d6a

SHA512
7bc73c62cfc864dd9d5c628564a3a1d2ed4d5a017dae765dccdc9c8f386083fbcaa48aed8cb0c6ce9d1abd9dc97273f8c5b484f83ac2734c7ded14eeeb16e3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
304B

MD5
6d8ae99a242dbdcab738e83e91f11669

SHA1
b1f6eff4f73e7591d05ff53ded0a00332405c2cb

SHA256
0747af692e17b7f50c22af9875d8a0eb046c08c4d0bb849c574af809b1d739b2

SHA512
9a56c78de7d5c14236c68a91e5453685dfb047c5005a8ba6eedd95b29dd523ee718b12df861c000ec9c4bfaa12e73790f9b05d909d2a5eaf726edd009c0ec94d

Download Submit
memory/1560-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1560-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-20-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2184-29-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download