urelas | 5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652

General

Target
9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
Size 84KB
Sample240805-rt7tbssfng
SHA256 5bdf8c0bd4b6bfef666605a0f007affdaa0c25683b1181c08ea425a75ac0d652
MD5 9ec9f0b2fb31fc1676c54936e2cb49b0
SHA1 33d519d1dd5834131134838e24d28dd66f2f2612
SHA512 7572b9416f68004a4496b152d7c29bbe76873afe4a59436b328893f348aa38840d1cbefdc0eb6ca88265cd681d8dd53224deb66e09e0f923826ba84450b52203
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFr:JznH976dUCnuniDN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

C2

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe

Executes dropped EXE 1 IoCs

pid	Process
2052	huter.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1900-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/files/0x00090000000235d2-6.dat	upx
behavioral2/memory/1900-17-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2052-20-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2052-22-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2052-28-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2052	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	93
PID 1900 wrote to memory of 2052	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	93
PID 1900 wrote to memory of 2052	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	93
PID 1900 wrote to memory of 3104	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	94
PID 1900 wrote to memory of 3104	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	94
PID 1900 wrote to memory of 3104	1900	9ec9f0b2fb31fc1676c54936e2cb49b0N.exe	94

C:\Users\Admin\AppData\Local\Temp\9ec9f0b2fb31fc1676c54936e2cb49b0N.exe
"C:\Users\Admin\AppData\Local\Temp\9ec9f0b2fb31fc1676c54936e2cb49b0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1904,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
MD5 a01dba4c45102fc15292fd5591166536
SHA1 d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA512 277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 84KB
SHA256 aaddacdbad09bedd3ebea4480828f06711f53ddca133631fd8a2f2e2476bbb27
MD5 8d3e173d6ec027f2a31cd3a981c78491
SHA1 cf30189543d605603dc0bdc58738bc23e419be37
SHA512 c0b0d431ca35b22b04ba075f1223aaeba3a9c086d451c7e51abf358f6e3b858228769e78704bec16ac9b74ef69f1d29e3c11ab064b11b701b760fbcb218b8d64
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURFu:JznH976dUCnuniDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 276B
SHA256 2a491280931f7b76047d2b1eace3e9cfa06254f4ed39fcb267705008bb85977a
MD5 5eacf3fde6756c8d37df843d78173f3a
SHA1 09034f48ef63213f0fdd31d63a104604ffa2513e
SHA512 2b8d87198d6c988cea05d30318188a6eda5cec84f598f4840beb227245be67ab21e9a45b571328edec53804155a8d8eb316e45e73222e859c05655c7bf00862e
MD5 SHA1 SHA512

Submit Download

memory/1900-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1900-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2052-20-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2052-22-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2052-28-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads