urelas | fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe
Size

79KB
MD5

5d6d513cf8349694df4254579c218ac8
SHA1

f00b37380f266540c87ab1b68dd4dca10019fdcb
SHA256

fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c
SHA512

157ee0a21466eb7017280171cc444083ba433fe02d9540306834dd9e54a26daa5780e4f4e1e128aa5cf4da4ebf47ba802e2e55348ef0e09dbae458734c2e9d97
SSDEEP

1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEk:9RkjWjK9ABpGzlaRQLl

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

2612 huter.exe

pid	process
2612	huter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3764-0-0x0000000000A70000-0x0000000000AA1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\huter.exe	upx
behavioral2/memory/2612-15-0x0000000000CF0000-0x0000000000D21000-memory.dmp	upx
behavioral2/memory/3764-18-0x0000000000A70000-0x0000000000AA1000-memory.dmp	upx
behavioral2/memory/2612-21-0x0000000000CF0000-0x0000000000D21000-memory.dmp	upx
behavioral2/memory/2612-23-0x0000000000CF0000-0x0000000000D21000-memory.dmp	upx
behavioral2/memory/2612-25-0x0000000000CF0000-0x0000000000D21000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe

description	pid	process	target process
PID 3764 wrote to memory of 2612	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	huter.exe
PID 3764 wrote to memory of 2612	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	huter.exe
PID 3764 wrote to memory of 2612	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	huter.exe
PID 3764 wrote to memory of 2100	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	cmd.exe
PID 3764 wrote to memory of 2100	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	cmd.exe
PID 3764 wrote to memory of 2100	3764	fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe
"C:\Users\Admin\AppData\Local\Temp\fe3d184fa112c9b908e9a584ce056d10dd6ed12f19838f9748bc4f45c293412c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55d2fdd1432483e3ba86ebeccfe130b6

SHA1
7280b14d708800fd15303b2caa8628a0fbd7aa08

SHA256
5cfd1668ec0e5f3b5f8d04e54091d6f173bede6e6f9bb418819fd550095139fb

SHA512
36fd81128552356672b52936699c5e6362268c8131857e778e02a6862600c4feb20d13063d5f838e0887cb5083c648d39fe07faffba18c26387760752f9dd1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
79KB

MD5
4893c30a9c3f8b85662be5a7e829b7f7

SHA1
7d84e8559dbdc1dbaad5002ef262810d0b08409b

SHA256
6457f3e4c5276504839454b213745d62180fa9e3132faf57f41d1dacb0260932

SHA512
1e783b912a2979261ecb97c031cc7aeff9c9620ce51d166fa539809a3b9c7475265dc7bf7c2933e9f096ecf6f44d2b3e6380679f3873d811368ed1016b2964b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
f99d52e5583084f2665887927a73f105

SHA1
3d50a8ba08dbb59b40f9b78d759c74b4e3244209

SHA256
c002890a15b0fb8875571861ab0e39bc9122e8a1e2dff58aa1a051a3cb9aac5c

SHA512
bf893b7c5508d8ae2d58ff2cfce87bd2367c16cdba4561aa84ca5c50136023dc17ae7d43b255dea1cf4a81421223f7538a9caaffd57fb7e4197e83a9eca7726e

Download Submit
memory/2612-15-0x0000000000CF0000-0x0000000000D21000-memory.dmp

Filesize
196KB

Download
memory/2612-21-0x0000000000CF0000-0x0000000000D21000-memory.dmp

Filesize
196KB

Download
memory/2612-23-0x0000000000CF0000-0x0000000000D21000-memory.dmp

Filesize
196KB

Download
memory/2612-25-0x0000000000CF0000-0x0000000000D21000-memory.dmp

Filesize
196KB

Download
memory/3764-0-0x0000000000A70000-0x0000000000AA1000-memory.dmp

Filesize
196KB

Download
memory/3764-18-0x0000000000A70000-0x0000000000AA1000-memory.dmp

Filesize
196KB

Download