urelas | f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb

General

Target

f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe
Size

93KB
MD5

3e2d1f232c5a6ba7c01b891716e9c4bb
SHA1

61d535cce9c81f45a1ef54e9323fc3be2fa899e3
SHA256

f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb
SHA512

0c7e3e619d1a4b8bd29bafbf885a2428efabb73c072dddae86c9463b80699380b4febfa8e007f3f6f48cba3db63ac2b6064c1a6f3c4e2402ffa0fbf5c6e1b05a
SSDEEP

768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4U+:OVNSf7hyk+I6412V6PMqAax80XAFSrRo

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\huter.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2216-17-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2744-18-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2744-21-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2744-23-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2744-30-0x0000000000400000-0x0000000000438000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2160 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

2744 huter.exe
Loads dropped DLL 1 IoCs

Processes:

f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe

pid process

2216 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2160	cmd.exe

pid	process
2744	huter.exe

pid	process
2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe

description	pid	process	target process
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2744	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	huter.exe
PID 2216 wrote to memory of 2160	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	cmd.exe
PID 2216 wrote to memory of 2160	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	cmd.exe
PID 2216 wrote to memory of 2160	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	cmd.exe
PID 2216 wrote to memory of 2160	2216	f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe
"C:\Users\Admin\AppData\Local\Temp\f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d8c69e006046149f40585fb3e1bfafb4

SHA1
97073fb1d116248dbecd009e4bf873ab45c6c2da

SHA256
df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228

SHA512
b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
2e78d15e9c44326c0c9ff68313c97456

SHA1
e9663f3f5b08ca87e7a6a8eef59cdc04a5141768

SHA256
37188f5d58697e6cac205245ecf986066e280842e0b599eae718eb47c9f1d5d9

SHA512
ad077a0a64ca9f1528bd4ce26f9db91424a3f29a5f398edbd4655565d501392d0531e1c33de23e416cfa7216092bb081c91f62a75f6e9a25f6696bea270ac19b

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
93KB

MD5
c5dd865a4146f98c4666fc1aca4416bc

SHA1
9e423be20025755a769da31c05e03a877746459b

SHA256
bc8b646c6e2c19b0fef42f8d55975b62ed5d5442cfd66f2b80d65a066c79b22c

SHA512
0c4afc481c735e6eed4d77adb0ffa1bd13504219531f91ef09b2dbfb0673ecef0fa40b783d327eed9603055d932e9b3640f1b8b39a0f03d8c721b6665bd50a9a

Download Submit
memory/2216-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2216-8-0x0000000001D40000-0x0000000001D78000-memory.dmp

Filesize
224KB

Download
memory/2216-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2744-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2744-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2744-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2744-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing