urelas | 5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe
Size

83KB
MD5

72b5b7e0d5f45f6db284285f78139e60
SHA1

9d10e792b1210f10c5474273525853770c807f3e
SHA256

5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2
SHA512

533b14e2a8d948dfd1a83ecb9209b2263e3e21238b0b5d9be54ad8968fccb4e3b440147ddf4c54c39ed9d873a1e037528acc3c8e8c3882d611554b9971058cdd
SSDEEP

1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkUR0q:JznH976dUCnuniDwq

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

1816 huter.exe

pid	process
1816	huter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1628-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\huter.exe	upx
behavioral2/memory/1816-15-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1628-17-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1816-20-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1816-22-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1816-28-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe

description	pid	process	target process
PID 1628 wrote to memory of 1816	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	huter.exe
PID 1628 wrote to memory of 1816	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	huter.exe
PID 1628 wrote to memory of 1816	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	huter.exe
PID 1628 wrote to memory of 4384	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	cmd.exe
PID 1628 wrote to memory of 4384	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	cmd.exe
PID 1628 wrote to memory of 4384	1628	5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d79eb86d5c2b6f7a4461b00a97260e9d1da4de76df8839b052aaba231de45f2_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a01dba4c45102fc15292fd5591166536

SHA1
d96191c30e0f09439d8547f4ededbf6726ccd54b

SHA256
cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904

SHA512
277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
83KB

MD5
08d80328b2965f877f4571e1cac6c8d2

SHA1
1542b6692c8f64be5d2a1491eeb059d2a0462eac

SHA256
e965492de7029210c03ef7ff220991880ed95797fedae182b9b90890e0cc72d5

SHA512
2ff4f40dda1bb50937b041823a36ff112e1fa08477fa7b921f9427aaa2235e12fcbd8528967b0f4120c0a507081f46e76e6da52ca29f4a491c99918d9319820b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
368B

MD5
f73e9b72b658d7158fd9cf1b5bd25a71

SHA1
61e5255143022917746f04917448c7a4806b2d88

SHA256
8eafe1248d4c46284491a4a4cdd7766d9af9a31a7e7ac310559a756d25fa963f

SHA512
67b1c9c65cc96de4add2bd01ec552e4f44fd72d7a78f8d0a2a269384eb701a049395194aa628cc04b2304df692891cf8d9bed52fb2770c226e1218bb3848488c

Download Submit
memory/1628-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1628-17-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1816-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1816-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1816-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1816-28-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download