urelas | 75a41f26bd62593d4add7be81d33cb705861b93a8f7930eba6c3b69b16d4adcb

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe
Size

94KB
MD5

5dfcb357d33b2c2fcc01d5189b166b50
SHA1

b34d0f72ff2c98d0a1de84e57df9fe75868b5457
SHA256

75a41f26bd62593d4add7be81d33cb705861b93a8f7930eba6c3b69b16d4adcb
SHA512

4fe001faf6c768c04e8e4a3365880b9f5c172951cf935d93db5d7c83a2099d5f754885e53ccc41dad5c393bf5d7844cb64780d5423c4ab313f423dde3f7191bf
SSDEEP

1536:OVNSf7hyk+I6412V6PMqAax80XAFSrRjm:SSf9yk+U2V63XAFSrRC

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2184 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

1988 huter.exe
Loads dropped DLL 1 IoCs

Processes:

5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe

pid process

1160 5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2184	cmd.exe

pid	process
1988	huter.exe

pid	process
1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe

description	pid	process	target process
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 1988	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	huter.exe
PID 1160 wrote to memory of 2184	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	cmd.exe
PID 1160 wrote to memory of 2184	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	cmd.exe
PID 1160 wrote to memory of 2184	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	cmd.exe
PID 1160 wrote to memory of 2184	1160	5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5dfcb357d33b2c2fcc01d5189b166b50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\huter.exe
"C:\Users\Admin\AppData\Local\Temp\huter.exe"
2⤵
- Executes dropped EXE
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
d8c69e006046149f40585fb3e1bfafb4

SHA1
97073fb1d116248dbecd009e4bf873ab45c6c2da

SHA256
df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

SHA512
b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
304B

MD5
1b9db20dac02d813c043fad33b64268c

SHA1
9efa27e85d8d61f9bc5e59797b15afee7e286f52

SHA256
6d566895538f5bbbb48503ec012a9d1e4634643d60f26f1b8b70c549d214e9f7

SHA512
f2c72744decc12cb26e30cd493e3cb01fc37f730fc328cc092726809d319312f555c4e44910454e21bddb5a0fd62792c2b5c6a57898b022b497a7be42c566c87

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe
Filesize
94KB

MD5
cdb0ec9caeba1f18c2bb280140a67800

SHA1
8f7c6ce6e67625856a884cabe9fe97fd3a19c5d4

SHA256
99c6fe4d2ddcb1585eb8c87e76c68201c88ae5887cd41d2ebb028d9d985eaa9c

SHA512
8f9543c257db3626b9b01c3b3c8c21d621002ef8bba8af9ac5d1ebf4c966adae56770b584447f3cc38fd47279f044e4a23069cc9177e5c9b18ab5c1906819b4d

Download Submit
memory/1160-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1160-15-0x0000000002BA0000-0x0000000002BD8000-memory.dmp

Filesize
224KB

Download
memory/1160-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1988-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1988-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1988-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1988-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download