urelas | f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137d

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe
Size 84KB
Sample241001-px53sstfle
SHA256 f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137d
MD5 3a0ba2d29da41527646dbe93347d2640
SHA1 e543ece3fcd851df7493ad6558d3e864b9ce5ec3
SHA512 3380b8b5163489be741fb388012c0b4a521ca3d03d9c22ae8dd755aaf2b41af424256ebea7ee28d08a352f60336cd115b27d5f7674f1a25af718d0949ea94833
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURs:JznH976dUCnuniD4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe

Executes dropped EXE 1 IoCs

pid	Process
1536	huter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2088-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/files/0x0007000000023431-6.dat	upx
behavioral2/memory/1536-15-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2088-17-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1536-20-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1536-22-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/1536-29-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1536	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	82
PID 2088 wrote to memory of 1536	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	82
PID 2088 wrote to memory of 1536	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	82
PID 2088 wrote to memory of 2744	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	83
PID 2088 wrote to memory of 2744	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	83
PID 2088 wrote to memory of 2744	2088	f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe	83

C:\Users\Admin\AppData\Local\Temp\f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe
"C:\Users\Admin\AppData\Local\Temp\f09eb0fa73736c0490e6f93895d2bec1f2471b91a9ce37a4564388d1e214137dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
MD5 a01dba4c45102fc15292fd5591166536
SHA1 d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA512 277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 84KB
SHA256 d256de5d128fa43998a3974e190d76fa4dbf3a0bfc673096253b2885da180abc
MD5 17d9cf63ed4ca0011aaf819386a49163
SHA1 98f7845ec6f96dcc3f95f1d8dcbbf0505731b118
SHA512 c9652255deb572484e9770b159140490643898793f98b72e4b51e773a8bc588b61cd73e49caa582aed4b3b1bc343a3a13a68db73ee4cc538cf84ab39ffe267b7
SSDEEP 1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURO:JznH976dUCnuniD6
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 340B
SHA256 997eba944dcc3b36db8f8163f2f6552901c0a80305b3fe8a5f2c7c055b600e1f
MD5 db0a1eb8093d7994937ddc02708215ec
SHA1 0e186c90c79596e1a96ad6fd331d4cf96348315d
SHA512 66077ee4be0c21d944c15f71512a1acf15714ad9068ae5174145acd4b560a404019c8c7b25763149ea3b97a1b8fc79a98d8f91045de2d0b5c7bacd2677b54f54
MD5 SHA1 SHA512

Submit Download

memory/1536-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1536-20-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1536-22-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1536-29-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2088-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2088-17-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads