urelas | 78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe
Size

94KB
MD5

3121f8930cb0e5744b1840e92e33737d
SHA1

385361bc3174d7492a218c2b2ad939661633b931
SHA256

78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93
SHA512

720d14fc8a420bb3a8738eeab80d59a538471c5c6fb2d707e81499593237ba519329cded2e2b284024e7b337c4dad19ed6c139620349d205ce5a5004dd0d5bf6
SSDEEP

1536:h7OvGm5eIEV6BJNEOk10Q6iYHmlmUO/+oRhjv3eLFJA1a:h7JmwILKr10y2p92JLF4a

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

3616 huter.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3616	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe

description	pid	process	target process
PID 4796 wrote to memory of 3616	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	huter.exe
PID 4796 wrote to memory of 3616	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	huter.exe
PID 4796 wrote to memory of 3616	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	huter.exe
PID 4796 wrote to memory of 5088	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	cmd.exe
PID 4796 wrote to memory of 5088	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	cmd.exe
PID 4796 wrote to memory of 5088	4796	78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe
"C:\Users\Admin\AppData\Local\Temp\78aeef8587aa0b02578525edd61a294079f674f0eb75c766f0741fed0f06ba93.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4796

C:\Users\Admin\AppData\Local\Temp\huter.exe
"C:\Users\Admin\AppData\Local\Temp\huter.exe"
2⤵
- Executes dropped EXE
PID:3616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
b11ee6960b3807d119948e9eb5b82cb1

SHA1
2901ef0072deccd2d364dfc8bf791d1f0656ca42

SHA256
bdce2a8184d13f0eecbcc5201685ca0b733f393aad9b271c028976eb826a9f34

SHA512
a2e55fcc2ea42b3e415751c437ae3dcb1d7a1cb703c56fd07d93a9a1222cd275ed4b2a34f85d92a412c085a1b042c6f9cccfc1c61d60a34a3f6ada1e498b9e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe
Filesize
94KB

MD5
5c86f5e26058af816e3e7dc10a903940

SHA1
1d9b1d761ae8548bc6605fcad2d381ccedf339a4

SHA256
b988a40c88ed079695693e908242a538cf050582b1d7e59d749aee00f2903ecc

SHA512
65f947439ebc0e8dca730d932aca45754095a45ebcf591647e86bfc67189ee2db73b7a34d4af7d5eade1c8658aba7c48499a5a2ac8398fb455631e26450008a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
338B

MD5
4cec24464a4728dbda620023af7531ec

SHA1
40ad3a4489d0b79115965be58b44b1a50e62fbdd

SHA256
30063e3b570da8dde37a6319bdffc4643e9358e67d855cf15f4dbf404fb8db7f

SHA512
5ec87571e6360d0dae38f47a5fb69ef8b09b86eb7d6702c97f0253ad04bc5c2646c4a28826c807b890e38e98ccae76172b505c12cdb1399bf10c0c2345e84829

Download Submit
memory/3616-11-0x0000000000690000-0x00000000006C1000-memory.dmp

Filesize
196KB

Download
memory/3616-18-0x0000000000690000-0x00000000006C1000-memory.dmp

Filesize
196KB

Download
memory/3616-20-0x0000000000690000-0x00000000006C1000-memory.dmp

Filesize
196KB

Download
memory/3616-26-0x0000000000690000-0x00000000006C1000-memory.dmp

Filesize
196KB

Download
memory/4796-0-0x0000000000EC0000-0x0000000000EF1000-memory.dmp

Filesize
196KB

Download
memory/4796-15-0x0000000000EC0000-0x0000000000EF1000-memory.dmp

Filesize
196KB

Download