urelas | 135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4

Analysis

max time kernel
149s
max time network
72s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Size

4.7MB
MD5

5381e8088a4d5443a40e1316522f8b79
SHA1

6004d42dc5828991c18bce4d18b03991d04b39f5
SHA256

135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4
SHA512

9438062848f45b92442e68ec86c5273823af740f64c142b353b19f057d1d607f96021595c573fa3ad319b9a27513f70ee4263f22b1e2115f335305c6026ee5b4
SSDEEP

49152:a2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURcI:a2V7NpW6Y6joUE

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.30.235

121.88.5.181

112.223.217.101

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2984	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

sander.exectfmom.exe

pid	Process
1448	sander.exe
1032	ctfmom.exe

Loads dropped DLL 2 IoCs

Processes:

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exesander.exe

pid	Process
1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
1448	sander.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.execmd.exesander.exectfmom.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sander.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ctfmom.exe

pid	Process
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe
1032	ctfmom.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exesander.exe

description	pid	Process	procid_target
PID 1464 wrote to memory of 1448	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1464 wrote to memory of 1448	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1464 wrote to memory of 1448	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1464 wrote to memory of 1448	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1464 wrote to memory of 2984	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1464 wrote to memory of 2984	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1464 wrote to memory of 2984	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1464 wrote to memory of 2984	1464	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1448 wrote to memory of 1032	1448	sander.exe	34
PID 1448 wrote to memory of 1032	1448	sander.exe	34
PID 1448 wrote to memory of 1032	1448	sander.exe	34
PID 1448 wrote to memory of 1032	1448	sander.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\ctfmom.exe
    "C:\Users\Admin\AppData\Local\Temp\ctfmom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
331B

MD5
22ba921d8d6e205aa419a60f87ef19e7

SHA1
e71bb89d34222ecf12d71df76adde48e7dada0c2

SHA256
5d70927cbabdbcd2a4a39085911bc322ffafd29b33b3191298a9d4bc0683fd6c

SHA512
726c2247b86e3364b7a6c4f77f5d94ba35be38b98c09880ea1044c45fee18a6ffe6de1ebf8c4717375d956e5e8ad2125deb9a3f3680a661baddedfc220a4aa64

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
04113afab96ff36e7da4cabf336079cf

SHA1
2ab6a01f123c1ef4227cb134612749b67a237bf6

SHA256
8b3cc0c31002ffa60f497966a671ff1c0a23a6efa831bd2be2cfbee7588bac16

SHA512
68358e6ae577e59dd540c31d4cfcf56968d9b84416ffcd527867711165d78a9f351da0bf41afab96107b1dc736467b092f5b79be2b8f7f96f6871e4a0b5472e9

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmom.exe

Filesize
221KB

MD5
4b6d4da0d000bcde5eef72c71b26489e

SHA1
11a8d1606d3e917f42d1126e945887e22b0139fe

SHA256
60838ae7ba0a28f44d340d561da56aea067c1938beac879f2f50fb311284d984

SHA512
a4ba8b6290f8f3e1d637fe846b77d009c05fa94e7b4318d0d08e1c0839a75e1fcd492eccbb77cbdd3cddeb780e3ca1dada80152818cad07e45149469f72040af

Download Submit
\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
4.7MB

MD5
1d4b58620c7834798ddade096c11831e

SHA1
34aa6b6f1f8800476411dd82c5a9bf7a79966fb4

SHA256
9da6299e1021883e91f8732dd00fe0ad00d60b99cb03e8774884e41fc8a8ab04

SHA512
07cf29730e02585178801379b72eba43553ca91b12e11f1491316b27ad660e24aa570e1155a896e17b0dff67b80d9ca108333dbc380605ddef356b028728daad

Download Submit
memory/1032-40-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-39-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-35-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-38-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-41-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-33-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-37-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-29-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-36-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1032-34-0x0000000001210000-0x00000000012B1000-memory.dmp

Filesize
644KB

Download
memory/1448-32-0x0000000000D40000-0x0000000001223000-memory.dmp

Filesize
4.9MB

Download
memory/1448-27-0x0000000003650000-0x00000000036F1000-memory.dmp

Filesize
644KB

Download
memory/1448-21-0x0000000000D40000-0x0000000001223000-memory.dmp

Filesize
4.9MB

Download
memory/1448-16-0x0000000000D40000-0x0000000001223000-memory.dmp

Filesize
4.9MB

Download
memory/1464-0-0x0000000001390000-0x0000000001873000-memory.dmp

Filesize
4.9MB

Download
memory/1464-18-0x0000000001390000-0x0000000001873000-memory.dmp

Filesize
4.9MB

Download
memory/1464-14-0x0000000003CE0000-0x00000000041C3000-memory.dmp

Filesize
4.9MB

Download