urelas | 135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
Size

4.7MB
MD5

5381e8088a4d5443a40e1316522f8b79
SHA1

6004d42dc5828991c18bce4d18b03991d04b39f5
SHA256

135807bfc79183f8064315a6b2086ee0933d1f5b44c1e3ab20fbe9824ece90a4
SHA512

9438062848f45b92442e68ec86c5273823af740f64c142b353b19f057d1d607f96021595c573fa3ad319b9a27513f70ee4263f22b1e2115f335305c6026ee5b4
SSDEEP

49152:a2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURcI:a2V7NpW6Y6joUE

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.30.235

121.88.5.181

112.223.217.101

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2812	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2760	sander.exe
2892	ctfmom.exe

Loads dropped DLL 2 IoCs

pid	Process
1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
2760	sander.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sander.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe
2892	ctfmom.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2760	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1728 wrote to memory of 2760	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1728 wrote to memory of 2760	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1728 wrote to memory of 2760	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	30
PID 1728 wrote to memory of 2812	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1728 wrote to memory of 2812	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1728 wrote to memory of 2812	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 1728 wrote to memory of 2812	1728	2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe	31
PID 2760 wrote to memory of 2892	2760	sander.exe	33
PID 2760 wrote to memory of 2892	2760	sander.exe	33
PID 2760 wrote to memory of 2892	2760	sander.exe	33
PID 2760 wrote to memory of 2892	2760	sander.exe	33

C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-01_5381e8088a4d5443a40e1316522f8b79_magniber_qakbot.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\ctfmom.exe
    "C:\Users\Admin\AppData\Local\Temp\ctfmom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
331B

MD5
22ba921d8d6e205aa419a60f87ef19e7

SHA1
e71bb89d34222ecf12d71df76adde48e7dada0c2

SHA256
5d70927cbabdbcd2a4a39085911bc322ffafd29b33b3191298a9d4bc0683fd6c

SHA512
726c2247b86e3364b7a6c4f77f5d94ba35be38b98c09880ea1044c45fee18a6ffe6de1ebf8c4717375d956e5e8ad2125deb9a3f3680a661baddedfc220a4aa64

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
04113afab96ff36e7da4cabf336079cf

SHA1
2ab6a01f123c1ef4227cb134612749b67a237bf6

SHA256
8b3cc0c31002ffa60f497966a671ff1c0a23a6efa831bd2be2cfbee7588bac16

SHA512
68358e6ae577e59dd540c31d4cfcf56968d9b84416ffcd527867711165d78a9f351da0bf41afab96107b1dc736467b092f5b79be2b8f7f96f6871e4a0b5472e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
4.7MB

MD5
548cf1e1bbaa7e0d58348ad5f1dc462c

SHA1
8c5aedf0204ae7daf0ea9d0d275069b10090e6b0

SHA256
47ca886f491b3ebd56861a87ed2f98902fc72d16a66e07e8b9334d728d22294e

SHA512
b9fe354f0b8d43ff17cec2f6f408d9e4c909fde1a9920d6db0ce2e02452d6a3ae455271a71ef5a87c85e9de7a752225a0c851e0f03142b71cc3cc787fbbd5241

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmom.exe

Filesize
221KB

MD5
c19d0c36bf61bded70de5b34d8fc9855

SHA1
d091a565f980a9a2aaa4426df855534d9b636260

SHA256
f38c1479d5fdea94537d59668efdc761a55a861dc14c69de768c95bc258ced3a

SHA512
c9367d566e1792b74594e44bdbefb5db8ee0122501b6ba6d8288617c5b250dff5052173cf0649c3f7960905a9cf7f965be7ff48c386a0af90d5dcd6fabf72fc2

Download Submit
memory/1728-0-0x00000000000A0000-0x0000000000583000-memory.dmp

Filesize
4.9MB

Download
memory/1728-16-0x00000000000A0000-0x0000000000583000-memory.dmp

Filesize
4.9MB

Download
memory/2760-17-0x00000000010E0000-0x00000000015C3000-memory.dmp

Filesize
4.9MB

Download
memory/2760-20-0x00000000010E0000-0x00000000015C3000-memory.dmp

Filesize
4.9MB

Download
memory/2760-30-0x0000000004280000-0x0000000004321000-memory.dmp

Filesize
644KB

Download
memory/2760-32-0x00000000010E0000-0x00000000015C3000-memory.dmp

Filesize
4.9MB

Download
memory/2892-31-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-27-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-33-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-34-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-35-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-36-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-37-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-38-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-39-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-40-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download
memory/2892-41-0x0000000000AB0000-0x0000000000B51000-memory.dmp

Filesize
644KB

Download