urelas | 931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840

Sharing

Copy URL Twitter E-mail

General

Target
931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840
Size 4.4MB
Sample240810-ad9jjswekl
SHA256 931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840
MD5 cc054ce55a31d69d03f9cf66917ac453
SHA1 38e6faaaeb67bc49d44876771b05c91d1b6f39d3
SHA512 9d0b4f367ebdd09c36c5392d2bab238d6dfcdc7f45fb8e051c181d737dce2807a960667a04e1944d6fbfa5836bb363476bbea53bcd5c725b7d9d49f0166d97ea
SSDEEP 24576:cUowYcOW4NcW9tGw2Eu8CkdhpIIZxYETKtZK/nyr5DBpX:GcOukjS8JdIaxpTK0nyNnX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840

File Explorer

931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840

.exe 4.4MB

931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840

IMPHASH 78cbfd92c4a2c4baef4202ec751e4238
SHA256 931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840
MD5 cc054ce55a31d69d03f9cf66917ac453
SHA1 38e6faaaeb67bc49d44876771b05c91d1b6f39d3
SHA512 9d0b4f367ebdd09c36c5392d2bab238d6dfcdc7f45fb8e051c181d737dce2807a960667a04e1944d6fbfa5836bb363476bbea53bcd5c725b7d9d49f0166d97ea
SSDEEP 24576:cUowYcOW4NcW9tGw2Eu8CkdhpIIZxYETKtZK/nyr5DBpX:GcOukjS8JdIaxpTK0nyNnX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryW DeleteFileW CreateEventW CreateThread GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource FreeResource MultiByteToWideChar GetVersionExW CreateFileW GetFileSizeEx GetLastError GetCurrentProcessId TerminateProcess GetModuleHandleA GetProcAddress GetTempPathA GetModuleFileNameA CreateFileA WriteFile ReadFile SetFilePointer GetTempPathW DeviceIoControl SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte SetFileAttributesW SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CloseHandle OpenEventW GetFileAttributesW GetTickCount ExitProcess Sleep FlushFileBuffers GetModuleFileNameW SetStdHandle InitializeCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapAlloc HeapFree GetVersionExA GetProcessHeap GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetConsoleCP GetConsoleMode TlsGetValue

user32

LoadStringW LoadAcceleratorsW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

socket recv send closesocket connect WSAStartup htonl gethostbyaddr WSAGetLastError gethostbyname inet_addr htons

iphlpapi

GetAdaptersInfo

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

Name

.text

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RWDXpCnt

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

xIcoosxj

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ

Name

YxdQockM

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ZyLNEoBK

Size

252KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_MEM_READ

Name

YwClttuI

Size

152KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_MEM_READ

Name

myNLgrHJ

Size

202KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_MEM_READ

Name

LQMeesRM

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_MEM_READ

Name

kxeSqIfy

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_MEM_READ

Name

DsXJIkIu

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ddiTAdKL

Size

84KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_MEM_READ

Name

DKlGPYcl

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ

Name

rHkuOoeY

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

PZvmXBOO

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_MEM_READ

Name

JuDbhPgC

Size

49KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_MEM_READ

Name

mNpTzULX

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

QslomYpu

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

WmIsdGmW

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

zNIzJZEc

Size

289KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_MEM_READ

Name

Nxeqzhfn

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_MEM_READ

Name

lWeDIfAe

Size

364KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_MEM_READ

Name

zXCqhSEh

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ

Name

iUypEECT

Size

111KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_MEM_READ

Name

QTrKRQbD

Size

21KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ

Name

fiXZlKkw

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_MEM_READ

Name

WfljQmWy

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

DMMduHbc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ntNIkQPe

Size

63KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ttPRJHce

Size

41KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_MEM_READ

Name

JSqfHHdO

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

qicWpqhG

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ

Name

iQgigbQN

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ

Name

jYteLSFI

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_MEM_READ

Name

mKLdtGXk

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_MEM_READ

Name

EhRoIiEg

Size

46KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_MEM_READ

Name

edsavBFZ

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_MEM_READ

Name

UPGrwFzk

Size

58KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_MEM_READ

Name

UlKuZLPy

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

HHpJdKzU

Size

117KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_MEM_READ

Name

zSonfXEj

Size

128KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_MEM_READ

Name

HqiBCsEJ

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ

Name

EFPUPQAh

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_MEM_READ

Name

tgdWIWUc

Size

179KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_MEM_READ

Name

CVdRfpOu

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

lidfZglE

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

tYVbRcFi

Size

67KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_MEM_READ

Name

RzJxLWXY

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ

Name

RQnMaNrn

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ

Name

HwxQwVSG

Size

36KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_MEM_READ

Name

yAZmZPNu

Size

75KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_MEM_READ

Name

iNUEbUFB

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ZdltyIWJ

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ

Name

lzcLiPWs

Size

70KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_MEM_READ

Name

sWBsbBii

Size

71KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_MEM_READ

Name

LlCbjcuj

Size

29KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_MEM_READ

Name

yQFDPJzQ

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

VyFamBbZ

Size

34KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

jaewENcW

Size

46KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_MEM_READ

Name

EJxyHeAz

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_MEM_READ

Name

RyQTCOBS

Size

32KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

jHrEpAWe

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

JAAIFyxQ

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ

Name

EyxqiNMw

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

NbkOOxNJ

Size

28KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_MEM_READ

Name

oqfNnOtN

Size

19KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ALSchGYr

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_MEM_READ

Name

oIvyvmVD

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_READ

Name

qPGoiGpC

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

931c9f7961eb295aecfbe372b16b585a9b16e9dbd45321def2c320224995f840

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

wtsapi32

generic