urelas | 53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99f

Analysis

max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe
Size

50KB
MD5

26ab3dc9413d2223a505083f7403ed80
SHA1

0295975c24f422a0ff057a8c3e2c1d0eae180ff9
SHA256

53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99f
SHA512

3e5fe649ff3f18c68fd615aba2b4bf6ead1645b36160c65ff170cfebe0570358da612e35fb4b19e116b1cd18c5111038a704ed11631573c0f05e398eba99e499
SSDEEP

1536:h+Ds6ClDXuqweo/0khAUnJDgabGsVy6umfFlPhN:KsdXfBo/DBJBGzkP5N

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe

Executes dropped EXE 1 IoCs

pid	Process
816	shoste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shoste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 816	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	87
PID 1700 wrote to memory of 816	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	87
PID 1700 wrote to memory of 816	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	87
PID 1700 wrote to memory of 2164	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	88
PID 1700 wrote to memory of 2164	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	88
PID 1700 wrote to memory of 2164	1700	53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe	88

C:\Users\Admin\AppData\Local\Temp\53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe
"C:\Users\Admin\AppData\Local\Temp\53dfaf40d6aa07950b680d4b61975f90a9fc74feb4ee5007d07995a70262f99fN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\shoste.exe
  "C:\Users\Admin\AppData\Local\Temp\shoste.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f51c1462254f3bb8aa00201af0b0a030

SHA1
60d3c892bb5c4f654c318451012f936d81164418

SHA256
695c02a7ab1d4a3bf5060ab1c7c63f651dc1fd945c0c5c3263c23db769f689c5

SHA512
41059643033b10394b1593371e22542e4b7f504a3da36ca2cdbf28521dd24bd70d70f42c99f580227e9799c64b5c23c7b9182ca518245b66eb831868e043e0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
b58010a16a36a898c97a1447fbc755cf

SHA1
0fa76b62fda3f97ff6c57327662b2bb3de55363b

SHA256
ee7c3c4372dd4c03214883735a29beec943eaa23edb4c795989b692e0150cf31

SHA512
14a1f83e2c6c155cc023f2c7a9c6c12f238b2f584b04d765d2f7b6be6f6cda8da558438f01c4582f40491bd796163fb012aef7c5878a7017aa6ed802187bfb61

Download Submit
C:\Users\Admin\AppData\Local\Temp\shoste.exe

Filesize
50KB

MD5
b09694190afc2022672861220ddd6a86

SHA1
9375fb7b31f200cd26c2e120799c622272bf0aac

SHA256
32943a108a7e73aa618f77fa161f86c04eda7ca558ab0716498605ac4dd530ad

SHA512
da5a5bdd98a8e78a98f845b68ebebf36e30052fe819d531ecf7825325a8f4f56d3edb0bd0e0d652762c2263def0f66b73d8b7ef1bb5d336f5e1a00b536766cda

Download Submit
memory/816-12-0x0000000000410000-0x0000000000445000-memory.dmp

Filesize
212KB

Download
memory/816-17-0x0000000000410000-0x0000000000445000-memory.dmp

Filesize
212KB

Download
memory/816-24-0x0000000000410000-0x0000000000445000-memory.dmp

Filesize
212KB

Download
memory/1700-0-0x0000000000770000-0x00000000007A5000-memory.dmp

Filesize
212KB

Download
memory/1700-14-0x0000000000770000-0x00000000007A5000-memory.dmp

Filesize
212KB

Download