urelas | 879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d

General

Target

879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe
Size

81KB
MD5

c20f54b8d46648ee309f1cbe4aa1d3cf
SHA1

95d9433600f98efa9930e161046a0c8f835ddacc
SHA256

879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d
SHA512

800bfe7bb6e98a78f38833e79c78c0cf31e603594eb3ed2047fb0129c030ba31b78058b429ecc3eebe15387be4e0cf85a766df5db1ab33f6529867c775f2deae
SSDEEP

1536:JmBpNDAoG2kf4F+KfQwHq0NVFXqKseZ656KqBxhKYvonouy8GVUVhzf:8hDAb2VHR5aKsDIbTomAoutGVUVxf

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

C2

121.88.5.183

121.88.5.184

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000590000-0x00000000005C9000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\opert.exe	UPX
behavioral2/memory/660-12-0x0000000000BE0000-0x0000000000C19000-memory.dmp	UPX
behavioral2/memory/2932-15-0x0000000000590000-0x00000000005C9000-memory.dmp	UPX
behavioral2/memory/660-18-0x0000000000BE0000-0x0000000000C19000-memory.dmp	UPX
behavioral2/memory/660-24-0x0000000000BE0000-0x0000000000C19000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe

Executes dropped EXE 1 IoCs

Processes:

opert.exe

pid process

660 opert.exe

pid	process
660	opert.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000590000-0x00000000005C9000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\opert.exe	upx
behavioral2/memory/660-12-0x0000000000BE0000-0x0000000000C19000-memory.dmp	upx
behavioral2/memory/2932-15-0x0000000000590000-0x00000000005C9000-memory.dmp	upx
behavioral2/memory/660-18-0x0000000000BE0000-0x0000000000C19000-memory.dmp	upx
behavioral2/memory/660-24-0x0000000000BE0000-0x0000000000C19000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe

description	pid	process	target process
PID 2932 wrote to memory of 660	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	opert.exe
PID 2932 wrote to memory of 660	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	opert.exe
PID 2932 wrote to memory of 660	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	opert.exe
PID 2932 wrote to memory of 4904	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	cmd.exe
PID 2932 wrote to memory of 4904	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	cmd.exe
PID 2932 wrote to memory of 4904	2932	879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe
"C:\Users\Admin\AppData\Local\Temp\879a3e7f3b471579a2ead263007fdd80948757a759223071e48b95b16b40f73d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6735bbe93159782090eb9c49dde676c6

SHA1
6edec7009f27d90d36081a9d4a05fc6e6bde28e2

SHA256
f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217

SHA512
8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696

Download Submit
C:\Users\Admin\AppData\Local\Temp\opert.exe

Filesize
81KB

MD5
b4271a58e6e30736294c93405e467573

SHA1
478f8cb790d00910d91f3117e6e792abcd25a2af

SHA256
f541b0cff92d0cc431d7a4809c0fb6adb6f31a5c6dd8c4c760b0ad9b11ec2d19

SHA512
5b206303b414948f2a3a8127b774f1da3e3efa21efebe011d99bd1d7985b85e1d9aaf2977e5fa1216e74184c9461c6ecec6928d7c74669c96e1b6c6db55607c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
907ba39051cc8706d3256571323146db

SHA1
51d0869d175945aa386f668fc3b95ca237894129

SHA256
8fcf6432d922581483e7bc249ea0f59d08c041030c2d956fc907b5eeb48aa9f7

SHA512
e57d0b58c7f79526093be90fee3dd968ea50711a9c588c370313d90e7f5db3978221fab56ad56ad1948ddf5bc5c40a93ab575322d9246b28d4225ac19a84de3e

Download Submit
memory/660-12-0x0000000000BE0000-0x0000000000C19000-memory.dmp

Filesize
228KB

Download
memory/660-18-0x0000000000BE0000-0x0000000000C19000-memory.dmp

Filesize
228KB

Download
memory/660-24-0x0000000000BE0000-0x0000000000C19000-memory.dmp

Filesize
228KB

Download
memory/2932-0-0x0000000000590000-0x00000000005C9000-memory.dmp

Filesize
228KB

Download
memory/2932-15-0x0000000000590000-0x00000000005C9000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads