urelas | 5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652

Analysis

max time kernel
90s
max time network
94s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
Size 84KB
Sample240805-rt7tbssfng
SHA256 5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652
MD5 9ec9f0b2fb31fc1676c54936e2cb49b0
SHA1 33d519d1dd5834131134838e24d28dd66f2f2612
SHA512 7572b9416f68004a4496b152d7c29bbe76873afe4a59436b328893f348aa38840d1cbefdc0eb6ca88265cd681d8dd53224deb66e09e0f923826ba84450b52203
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFr:JznH976dUCnuniDN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2744	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2072	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2528-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/files/0x00290000000186c2-4.dat	upx
behavioral1/memory/2528-17-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/2072-20-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/2072-22-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/2072-28-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2072	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	30
PID 2528 wrote to memory of 2072	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	30
PID 2528 wrote to memory of 2072	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	30
PID 2528 wrote to memory of 2072	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	30
PID 2528 wrote to memory of 2744	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	31
PID 2528 wrote to memory of 2744	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	31
PID 2528 wrote to memory of 2744	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	31
PID 2528 wrote to memory of 2744	2528	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	31

C:\Users\Admin\AppData\Local\Temp\9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
"C:\Users\Admin\AppData\Local\Temp\9ec9f0b2fb31fc1676c54936e2cb49b0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
MD5 a01dba4c45102fc15292fd5591166536
SHA1 d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA512 277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 276B
SHA256 2a491280931f7b76047d2b1eace3e9cfa06254f4ed39fcb267705008bb85977a
MD5 5eacf3fde6756c8d37df843d78173f3a
SHA1 09034f48ef63213f0fdd31d63a104604ffa2513e
SHA512 2b8d87198d6c988cea05d30318188a6eda5cec84f598f4840beb227245be67ab21e9a45b571328edec53804155a8d8eb316e45e73222e859c05655c7bf00862e
MD5 SHA1 SHA512

Submit Download

huter.exe

Path \Users\Admin\AppData\Local\Temp\huter.exe
Size 84KB
SHA256 3b76d48ec9da58d15f652e340996ef66794a643957cdea4129e71c36f35db08a
MD5 83a4ec50111ae77084527d12ece6655f
SHA1 e2425d04fc617a9a9f9911887f2d9f8de0df1853
SHA512 c186f53b0a9b94c4f624eebb38f452ca3a3c9e434dd5d97fa530910ce81ed4426e419e325b2b9cb89172ea7be4e74847e7f89ecd4f31ecb94d5d01b2a25bd81e
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFn:JznH976dUCnuniDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-20-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2072-22-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2072-28-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2528-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2528-6-0x0000000002530000-0x0000000002561000-memory.dmp

Download

memory/2528-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads