urelas | 14b7f068dc8a430ce870190bca675d06fb6af26d340a5f1b969be1edbe286688

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96235f42aba170e84327956358b675a0_NeikiAnalytics.exe
Size

83KB
MD5

96235f42aba170e84327956358b675a0
SHA1

2393498d565f8423e879ca0c52854ca6bdadfeb8
SHA256

14b7f068dc8a430ce870190bca675d06fb6af26d340a5f1b969be1edbe286688
SHA512

ae1a6848028d1a792a78e6f1cb8201177b1c52949814071549813ca344b34152a7c3cf4288c644e62914aa26c380afae78264a8f01c5c0d64bd9184401f83302
SSDEEP

1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkUR/:JznH976dUCnuniD7

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2680 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

1800 huter.exe
Loads dropped DLL 1 IoCs

Processes:

96235f42aba170e84327956358b675a0_NeikiAnalytics.exe

pid process

1704 96235f42aba170e84327956358b675a0_NeikiAnalytics.exe

pid	process
2680	cmd.exe

pid	process
1800	huter.exe

pid	process
1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\huter.exe	upx
behavioral1/memory/1704-6-0x0000000001D80000-0x0000000001DB1000-memory.dmp	upx
behavioral1/memory/1704-18-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1800-21-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1800-23-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1800-29-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

96235f42aba170e84327956358b675a0_NeikiAnalytics.exe

description	pid	process	target process
PID 1704 wrote to memory of 1800	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	huter.exe
PID 1704 wrote to memory of 1800	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	huter.exe
PID 1704 wrote to memory of 1800	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	huter.exe
PID 1704 wrote to memory of 1800	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	huter.exe
PID 1704 wrote to memory of 2680	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2680	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2680	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2680	1704	96235f42aba170e84327956358b675a0_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\96235f42aba170e84327956358b675a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96235f42aba170e84327956358b675a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a01dba4c45102fc15292fd5591166536

SHA1
d96191c30e0f09439d8547f4ededbf6726ccd54b

SHA256
cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904

SHA512
277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
304B

MD5
1ea36897892d11709ccc8269572c7f43

SHA1
7f6a69f8e58e1db9814028e73e8ed175fe4b9d3a

SHA256
eb35055e26791e65ea0d6324c7d7709a4117f3cfb15023a25433f329139dfd98

SHA512
99ae42d7acd2702dff6a6c8e1fb53859155198873e4b7f6e84d91aaa339a3cc94869e753f5ca3daa8990d3faddee36f47f3e1f5fa7433a4e0eee323af0281636

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
83KB

MD5
96235f42aba170e84327956358b675a0

SHA1
2393498d565f8423e879ca0c52854ca6bdadfeb8

SHA256
14b7f068dc8a430ce870190bca675d06fb6af26d340a5f1b969be1edbe286688

SHA512
ae1a6848028d1a792a78e6f1cb8201177b1c52949814071549813ca344b34152a7c3cf4288c644e62914aa26c380afae78264a8f01c5c0d64bd9184401f83302

Download Submit
memory/1704-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1704-6-0x0000000001D80000-0x0000000001DB1000-memory.dmp

Filesize
196KB

Download
memory/1704-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1800-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1800-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1800-29-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download