urelas | df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe
Size 59KB
Sample240910-dg9khatdrm
SHA256 df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8
MD5 12546fbf0ce1d26465eb5c1c84019a60
SHA1 0ce48008cc03e0f257ce9799f9cff0874abaa647
SHA512 652619dd93d1f8f43d886c31541d0f4592a26c28d1240581b951ad9d71d7cc78ad2c5e8170e0900b5dc39b246955f4c148ebe9b19bbfd854e215133c5aa3411d
SSDEEP 1536:xAVpYPLsUDbXUzzqNANl9isgM5myeteYOH3p4Pel91:GVpYPx3S2K3ks3ff3p4091
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe

Executes dropped EXE 1 IoCs

pid	Process
1600	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1600	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	89
PID 3992 wrote to memory of 1600	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	89
PID 3992 wrote to memory of 1600	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	89
PID 3992 wrote to memory of 3168	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	90
PID 3992 wrote to memory of 3168	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	90
PID 3992 wrote to memory of 3168	3992	df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe	90

C:\Users\Admin\AppData\Local\Temp\df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe
"C:\Users\Admin\AppData\Local\Temp\df4be5355f0219dd432ec833ea3ee1705ab7fb940347db1c03a8dd97866843c8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1a642c68cd9771cc0f73ba498cf973bb560f34ac6f55ab17d26847a7714e34dc
MD5 a39f3ff1599241818ef65c0fd09039ed
SHA1 8d40b394a337a9da3330603fcd523842bccdf504
SHA512 32e59ac200465d2c6c53c76344bfc1382ad12359a4e691c0473a86ba00f264fe7a93925bfac6fb0e4e18ff1a913b2dbba87f6d707e2ce0eafdb861f42028286e
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 59KB
SHA256 bd032054b347290ca7ab169609ba2837dfeee8fc91120711b55c2ebdda237fd8
MD5 2ba84703785af0bbfb859adf17be774f
SHA1 461aa7bea1680ba3c889815a7ac165b7e300eeb8
SHA512 f32586f0e062fde143b3ab2fbc3470dd8f4757ef4736b89ec42ee67a958cddb47b5e599834679eaeba40cc96b031b6cc3d5a2b77b9020e502248d7ed6ae92b8a
SSDEEP 1536:xAVpYPLsUDbXUzzqNANl9isgM5myeteYOH3p4Pel9P:GVpYPx3S2K3ks3ff3p409P
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 be5c19a92a888f7aaf781669e4d2aa14243c7d879d3719c06668df3527d67a0c
MD5 d55b7fb7b064c16ae484439aea585e82
SHA1 c46233de2f2fe0f3e84419e17551b31f27ba0e68
SHA512 9b6332dd4d061839e0ee06cc292ce042f33a257fb69ae1317f5c08fb36bd93902e5829840b84ce8384091f428a326b33916818b552fb18a0d2722931f2994b05
MD5 SHA1 SHA512

Submit Download

memory/1600-10-0x0000000000C00000-0x0000000000C37000-memory.dmp

Download

memory/1600-18-0x0000000000C00000-0x0000000000C37000-memory.dmp

Download

memory/1600-20-0x0000000000C00000-0x0000000000C37000-memory.dmp

Download

memory/1600-26-0x0000000000C00000-0x0000000000C37000-memory.dmp

Download

memory/3992-0-0x0000000000680000-0x00000000006B7000-memory.dmp

Download

memory/3992-15-0x0000000000680000-0x00000000006B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads