urelas | e8c2cde4d1c2dc2c6ce653f50008e4e47844a142c2576b199419b79cb0fbb692

Analysis

max time kernel
102s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2aac6d86bd697e53e9a31eb139523650N.exe
Size 79KB
Sample240719-ajvycatelm
SHA256 e8c2cde4d1c2dc2c6ce653f50008e4e47844a142c2576b199419b79cb0fbb692
MD5 2aac6d86bd697e53e9a31eb139523650
SHA1 5e1047570e77d41dacaef83010d6a0df28c07eba
SHA512 7e0a0229b7f1ac544a3f7b78884de7fa0c3845bb1324748e7d6b3044feb9ac5ebab56c467468c0520256ae5a779f85602bc51eddf087a40096a41cc0b74f8190
SSDEEP 1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEg:9RkjWjK9ABpGzlaRQLd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	2aac6d86bd697e53e9a31eb139523650N.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	huter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-0-0x0000000000D60000-0x0000000000D91000-memory.dmp	upx
behavioral2/files/0x0009000000023399-6.dat	upx
behavioral2/memory/5024-13-0x00000000009E0000-0x0000000000A11000-memory.dmp	upx
behavioral2/memory/224-18-0x0000000000D60000-0x0000000000D91000-memory.dmp	upx
behavioral2/memory/5024-21-0x00000000009E0000-0x0000000000A11000-memory.dmp	upx
behavioral2/memory/5024-23-0x00000000009E0000-0x0000000000A11000-memory.dmp	upx
behavioral2/memory/5024-26-0x00000000009E0000-0x0000000000A11000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 5024	224	2aac6d86bd697e53e9a31eb139523650N.exe	87
PID 224 wrote to memory of 5024	224	2aac6d86bd697e53e9a31eb139523650N.exe	87
PID 224 wrote to memory of 5024	224	2aac6d86bd697e53e9a31eb139523650N.exe	87
PID 224 wrote to memory of 4064	224	2aac6d86bd697e53e9a31eb139523650N.exe	88
PID 224 wrote to memory of 4064	224	2aac6d86bd697e53e9a31eb139523650N.exe	88
PID 224 wrote to memory of 4064	224	2aac6d86bd697e53e9a31eb139523650N.exe	88

C:\Users\Admin\AppData\Local\Temp\2aac6d86bd697e53e9a31eb139523650N.exe
"C:\Users\Admin\AppData\Local\Temp\2aac6d86bd697e53e9a31eb139523650N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5cfd1668ec0e5f3b5f8d04e54091d6f173bede6e6f9bb418819fd550095139fb
MD5 55d2fdd1432483e3ba86ebeccfe130b6
SHA1 7280b14d708800fd15303b2caa8628a0fbd7aa08
SHA512 36fd81128552356672b52936699c5e6362268c8131857e778e02a6862600c4feb20d13063d5f838e0887cb5083c648d39fe07faffba18c26387760752f9dd1f3
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 79KB
SHA256 b575f11e66186d054dff261543608f7d0fd69085600ab1251aab51d847112467
MD5 530be877f7da9b1be6d5d999daa90a3b
SHA1 2937f208020d3408310387040901248ccc573790
SHA512 a5b7c15544e53e469ebc92fc4f0cc6d40396ed4954c57294c4d1b103771fab43715ae02d02f08998aa64bae2f7c2839a709ca618b5d4bfbb4ec165216f089afa
SSDEEP 1536:9HxkDvWdB7O9dKymMyCMGni2Lz1LaRQLDEC:9RkjWjK9ABpGzlaRQLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 276B
SHA256 2404c871caaeb3af0709385392ac9a0faae065f12e0288f850aaf88674ff3e1c
MD5 bef36df4eb29aa6daaec155b8d1d7636
SHA1 976d8148a8a9b35e554afb05548f2f8ab116ba8a
SHA512 272ad85687b544d1c3dd1f72319d8ab9f798efa37e9f3b946c80c423c1879ea3349c5a4df3d113c606a8f18e9cf5659364d498d95497cba1b21ff3ff5afc6e9c
MD5 SHA1 SHA512

Submit Download

memory/224-0-0x0000000000D60000-0x0000000000D91000-memory.dmp

Download

memory/224-18-0x0000000000D60000-0x0000000000D91000-memory.dmp

Download

memory/5024-13-0x00000000009E0000-0x0000000000A11000-memory.dmp

Download

memory/5024-21-0x00000000009E0000-0x0000000000A11000-memory.dmp

Download

memory/5024-23-0x00000000009E0000-0x0000000000A11000-memory.dmp

Download

memory/5024-26-0x00000000009E0000-0x0000000000A11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads