urelas | df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cd

General

Target

df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
Size

79KB
MD5

b39589f9343b509a07a49f759cb71630
SHA1

918aecfca8251c09ed87ff918fe0b6e117be79f2
SHA256

df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cd
SHA512

f3e0548dba15a50394bfad22347df3909eb0ede869c732a722b6b8c64355b300baf482711f268c95b3ea2ccd0d8f4e2581356a8aa14ef162058e5d43beb75ba3
SSDEEP

1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te5:4lnhYPlVMqmyAFIRRy

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2460	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
532	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 532	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	30
PID 1724 wrote to memory of 532	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	30
PID 1724 wrote to memory of 532	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	30
PID 1724 wrote to memory of 532	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	30
PID 1724 wrote to memory of 2460	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	31
PID 1724 wrote to memory of 2460	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	31
PID 1724 wrote to memory of 2460	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	31
PID 1724 wrote to memory of 2460	1724	df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe	31

C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
"C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
dd1155cbc9956e5dbeee97b18e3c4c5a

SHA1
e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

SHA256
53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

SHA512
1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
d6b71bd88f9654567f0c65423b7d9a73

SHA1
9fff28cb119fba7d1b4402c354ec63083aff1270

SHA256
cb16e3fe444d1fbe4891907cdd33a5b46389478d101f9772f84ed6c35407dd95

SHA512
4082ba1d2eabecbccc618f08993bdd491fab02a7f58a268bd559002aa8114e8d303274f5cde2c3a8701244dbe8f59c4fff778b9df7fec21475c4ddd6726d87e1

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
79KB

MD5
73b76c98d84a46cbc55f319df58887e4

SHA1
56b6b31b54cac5ec2908879cb6d4b757e8a47138

SHA256
c00ee30609fb6a0769327c9e6c74c737628908932a56053cc1fe2bcd9525607f

SHA512
a7ead8dbe37f7b752f81e8220514ca33007641683ce2db21994062d0f223b625bfa4ae13d36be86963a767d1dbcdd4b96d2588a482d7034549afe4e6bf8cee7b

Download Submit
memory/532-17-0x0000000000EF0000-0x0000000000F20000-memory.dmp

Filesize
192KB

Download
memory/532-22-0x0000000000EF0000-0x0000000000F20000-memory.dmp

Filesize
192KB

Download
memory/532-24-0x0000000000EF0000-0x0000000000F20000-memory.dmp

Filesize
192KB

Download
memory/532-31-0x0000000000EF0000-0x0000000000F20000-memory.dmp

Filesize
192KB

Download
memory/1724-0-0x00000000011C0000-0x00000000011F0000-memory.dmp

Filesize
192KB

Download
memory/1724-8-0x0000000001020000-0x0000000001050000-memory.dmp

Filesize
192KB

Download
memory/1724-19-0x00000000011C0000-0x00000000011F0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing