urelas | e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06

Analysis

max time kernel
89s
max time network
89s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
Size

134KB
MD5

b9d456f72aa9fddb7410de3b686aefe1
SHA1

8c461b35647a0c57134ec694eed4338e1d5dba27
SHA256

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06
SHA512

59b2b42e5c6064a9d82111151f0717fd114b79758889c402ba975a9d251a9e8d7ea2099f6448e2e5330333bc77a8e8c358cccf2a6456a5ba2ce624e4ddfd4623
SSDEEP

1536:New08ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2AjpH/e3msYpKZZkUR0:Y0uk8QsH47nW5ppfe3msYpKZZQ

Score

10^/10

urelas discovery trojan

Malware Config

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2100	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid	Process
2892	huter.exe

Loads dropped DLL 1 IoCs

Processes:

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe

pid	Process
2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exee2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exehuter.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe

description	pid	Process	procid_target
PID 2540 wrote to memory of 2892	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	29
PID 2540 wrote to memory of 2892	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	29
PID 2540 wrote to memory of 2892	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	29
PID 2540 wrote to memory of 2892	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	29
PID 2540 wrote to memory of 2100	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	30
PID 2540 wrote to memory of 2100	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	30
PID 2540 wrote to memory of 2100	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	30
PID 2540 wrote to memory of 2100	2540	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	30

C:\Users\Admin\AppData\Local\Temp\e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
"C:\Users\Admin\AppData\Local\Temp\e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a01dba4c45102fc15292fd5591166536

SHA1
d96191c30e0f09439d8547f4ededbf6726ccd54b

SHA256
cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904

SHA512
277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
134KB

MD5
ea116cdd3c19604421544ce94b4af5cb

SHA1
1786f06a7e0a09b1fb8cad9e9fac0c68591c0a45

SHA256
59c121f6711ee8b4f94af9f08f34ead8b1d8f1d795e51fb68c587fd5959ae02f

SHA512
b8788ca22c46978e79d83abe02501dd6029769f25cafa5aa86c18dc3d8a54bdd550435a6d2f090b8d6bd82187a12acd3cecd7e0e41891d4d1664c5b83b1de083

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c0599fdef20a6ccf72f32fcc9a3760f4

SHA1
a50c8735227921e29a37d57f5d0893e44cc1b8d8

SHA256
6839397c83735603b8bba34beb2d48273813862b528ad35a3e0f0bcfa04d7210

SHA512
25042ed5a007ebc4d4e94688ad10e6e37aae20df3d9eb149974d61feb26461c929021cd7c7e9128603b730b911ad0f2643727af8641f770c06f6c14837b7ebd9

Download Submit