urelas | 135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Size

4.7MB
MD5

5381e8088a4d5443a40e1316522f8b79
SHA1

6004d42dc5828991c18bce4d18b03991d04b39f5
SHA256

135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4
SHA512

9438062848f45b92442e68ec86c5273823af740f64c142b353b19f057d1d607f96021595c573fa3ad319b9a27513f70ee4263f22b1e2115f335305c6026ee5b4
SSDEEP

49152:a2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURcI:a2V7NpW6Y6joUE

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.30.235

121.88.5.181

112.223.217.101

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exesander.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sander.exe

Executes dropped EXE 2 IoCs

Processes:

sander.exectfmom.exe

pid	Process
4372	sander.exe
1932	ctfmom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ctfmom.exe2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exesander.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sander.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ctfmom.exe

pid	Process
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe
1932	ctfmom.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exesander.exe

description	pid	Process	procid_target
PID 3236 wrote to memory of 4372	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	88
PID 3236 wrote to memory of 4372	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	88
PID 3236 wrote to memory of 4372	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	88
PID 3236 wrote to memory of 5000	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	89
PID 3236 wrote to memory of 5000	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	89
PID 3236 wrote to memory of 5000	3236	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	89
PID 4372 wrote to memory of 1932	4372	sander.exe	102
PID 4372 wrote to memory of 1932	4372	sander.exe	102
PID 4372 wrote to memory of 1932	4372	sander.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\ctfmom.exe
    "C:\Users\Admin\AppData\Local\Temp\ctfmom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
331B

MD5
22ba921d8d6e205aa419a60f87ef19e7

SHA1
e71bb89d34222ecf12d71df76adde48e7dada0c2

SHA256
5d70927cbabdbcd2a4a39085911bc322ffafd29b33b3191298a9d4bc0683fd6c

SHA512
726c2247b86e3364b7a6c4f77f5d94ba35be38b98c09880ea1044c45fee18a6ffe6de1ebf8c4717375d956e5e8ad2125deb9a3f3680a661baddedfc220a4aa64

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctfmom.exe

Filesize
221KB

MD5
7c6562bb693f4be6b52280d3e54c9eb7

SHA1
6210bb7ac737e92d7355105bece98e13cbfd7c45

SHA256
a2012fc9e5e2290d8a824557ceeca5d3a62aad02379c2d52df4aa696cde00cb8

SHA512
f9fbdfc98ccbaab4cff4f6633a2124ac13fcdf6839d8b59b2378be5bc5532f3f6fcdbc41bfd71570735cac2fc3215680739645c24f9199ebd751889668b2d77b

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
04113afab96ff36e7da4cabf336079cf

SHA1
2ab6a01f123c1ef4227cb134612749b67a237bf6

SHA256
8b3cc0c31002ffa60f497966a671ff1c0a23a6efa831bd2be2cfbee7588bac16

SHA512
68358e6ae577e59dd540c31d4cfcf56968d9b84416ffcd527867711165d78a9f351da0bf41afab96107b1dc736467b092f5b79be2b8f7f96f6871e4a0b5472e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
4.7MB

MD5
762fa9962306094fed7eac365c25fd9d

SHA1
5510b48358094de720677cc9602ad4a940d68ad5

SHA256
22717284b89f2a0d3c8b91cab69fbbf8495facafd8c5a942a87394baeb99c848

SHA512
d1e6ef71726cf804c1dc9fd28c944e5d9954ec00c41bcb8722e2b68386d151bcba0dd3943bc0dc04733b33f32535e1419eaf106b6f108f65cf9ad689dc78f87a

Download Submit
memory/1932-26-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-33-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-41-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-40-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-28-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-27-0x0000000000610000-0x0000000000612000-memory.dmp

Filesize
8KB

Download
memory/1932-39-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-38-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-32-0x0000000000610000-0x0000000000612000-memory.dmp

Filesize
8KB

Download
memory/1932-37-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-34-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-35-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/1932-36-0x0000000000CC0000-0x0000000000D61000-memory.dmp

Filesize
644KB

Download
memory/3236-14-0x0000000000A80000-0x0000000000F63000-memory.dmp

Filesize
4.9MB

Download
memory/3236-0-0x0000000000A80000-0x0000000000F63000-memory.dmp

Filesize
4.9MB

Download
memory/4372-31-0x0000000000B00000-0x0000000000FE3000-memory.dmp

Filesize
4.9MB

Download
memory/4372-13-0x0000000000B00000-0x0000000000FE3000-memory.dmp

Filesize
4.9MB

Download
memory/4372-17-0x0000000000B00000-0x0000000000FE3000-memory.dmp

Filesize
4.9MB

Download