urelas | 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31/07/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
Size 84KB
Sample240731-blrt5staqa
SHA256 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b
MD5 166c1187a42f846248992b70afb497be
SHA1 cfbd1f3b3798a415139c4e336ce8ef9fa103237d
SHA512 4565a554f0ef7a0c5ea3476d58ff95c6d4d547b18e0c9630cee0fb3ed658416718fb537cafd770eec4c48115e7f2df8541a55611d8bd2f77d39bf6d5d10e863b
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURG:JznH976dUCnuniDS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2052	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1640	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/files/0x0008000000015f55-4.dat	upx
behavioral1/memory/2860-6-0x0000000002BE0000-0x0000000002C11000-memory.dmp	upx
behavioral1/memory/1640-10-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/2860-19-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1640-22-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1640-24-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1640-31-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1640	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	31
PID 2860 wrote to memory of 1640	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	31
PID 2860 wrote to memory of 1640	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	31
PID 2860 wrote to memory of 1640	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	31
PID 2860 wrote to memory of 2052	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	32
PID 2860 wrote to memory of 2052	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	32
PID 2860 wrote to memory of 2052	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	32
PID 2860 wrote to memory of 2052	2860	84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe	32

C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
"C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
MD5 a01dba4c45102fc15292fd5591166536
SHA1 d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA512 277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 b91838d7f251698e27bd43b0d199a998d2ca2f286befc70b50e23a0d8fee8e80
MD5 609ce0e460850082c0ebaa19e82c2597
SHA1 b6b475a8ff74cd1ac908cb70450f7bd52dbaa8ce
SHA512 d416bdb10800e56f971381fa843da964abfd0697dea7ec9801ad9b9e2bd9af4e6ad9e2ec6abae66174f142e606b791172b4d38379eec7c2d119052daaa6f8e12
MD5 SHA1 SHA512

Submit Download

huter.exe

Path \Users\Admin\AppData\Local\Temp\huter.exe
Size 84KB
SHA256 7a5db11581422b4b57007dbc31c55f1f0f5b75bcbcc3cff22c0fce70aafefba8
MD5 f9458c431ad6b2b318fe5e9ce2392f42
SHA1 a01fc1b8defed0dbb091fe846f7c4cd1f00e5bd3
SHA512 a0510be609e8ab9df627a6427b7e05892c0bbd5b9fc8f22b9e347e25e8cc2a5a2a07bf700b93261dfc4126f392fe4c60228d5de892b7aa4414340e096f04bf74
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkUR6:JznH976dUCnuniDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1640-10-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1640-22-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1640-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1640-31-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2860-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2860-6-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Download

memory/2860-19-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads