urelas | 1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe
Size 91KB
Sample240925-xmpl3avepb
SHA256 1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051
MD5 f59e29e4f5799380ebc460292e7db6e0
SHA1 f087d09e06e2db2d4627eb5d8b3ebe92f9278265
SHA512 84a88c240b5e6f7f4ea5bbd3a96ac5fe30ebcaf67d486939ab16b8337ce2c8e4efc3fbbc54aa308c7212da2ed160f0606337f95ae25e4ebb58e5d9a76b9dc3fd
SSDEEP 768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEm:heZqP25TuIfmS7Fv1aUZSD9yiIHo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.28.139
121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe

Executes dropped EXE 1 IoCs

pid	Process
1280	poldge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1280	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	83
PID 228 wrote to memory of 1280	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	83
PID 228 wrote to memory of 1280	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	83
PID 228 wrote to memory of 3232	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	84
PID 228 wrote to memory of 3232	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	84
PID 228 wrote to memory of 3232	228	1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe	84

C:\Users\Admin\AppData\Local\Temp\1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe
"C:\Users\Admin\AppData\Local\Temp\1e1f59aa4754c6167a8f142b022ca24c3af4e9cc2bf0d18efe64cf51ffaa3051N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27
MD5 3f372385bf24b44385f4b1251d3aca4d
SHA1 83546de6ba8f20bd08a15896d34f6242ed64352f
SHA512 d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7
MD5 SHA1 SHA512

Submit Download

poldge.exe

Path C:\Users\Admin\AppData\Local\Temp\poldge.exe
Size 91KB
SHA256 41126961b79e5052495d1aed17c3c4cbc9ce2db4f76dff847decfc652ce7df9c
MD5 23e646040ef7c6083b05f6387080b21b
SHA1 f13f4c6310481f1a8fc973472f03ebe1ea57d699
SHA512 4bdd176c2c1fd41c147e7742de381feb1c3b247ed924cf0012a4a7d1ba168fd06d8dbd09fa85172654e72f393ad756ad7e893082a75f73ce8e66968dddbdae50
SSDEEP 768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUE1:heZqP25TuIfmS7Fv1aUZSD9yiIHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 340B
SHA256 509b2755b0fe62cd078822c96b1a19ef188a77cea3f343cc7d4c0aff2bcd8ee6
MD5 32666a0ee0c15dbd3c7a787d6a2e20e7
SHA1 ac5ff0f5d0961f1ebf7c79e0334a5058a62d5b90
SHA512 aa122fc52f52c8f8ca8bf7b0b001fcf6f2357e28a74961a3cc2436dbb483e1e47d5af9c32fa5fb06b80cca2afd2c889a54a876a1c09f4db4805239ee0804a3de
MD5 SHA1 SHA512

Submit Download

memory/228-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/228-13-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1280-16-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/1280-23-0x0000000000400000-0x000000000043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads