urelas | 5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe
Size

73KB
MD5

62526530c6cc0e4dc85cbdde05b49779
SHA1

fcd30fd4136ef357bde96c57dcf67b2b25a32939
SHA256

5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62
SHA512

f51502bc848445acf0ca86a709ace129648fa8a0521fd03cd50a8dbdf2b18a96987f816daa77fc36b5690ded8c44114f00aca45186120bdece3b86b0caee33aa
SSDEEP

1536:+Uk8RgDXz7Kx8zzgmTlvtKrNCpbXmsz4tHk:Tk8yn7KdmTINQXzz4m

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe

Executes dropped EXE 1 IoCs

pid	Process
4520	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4520	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	90
PID 1248 wrote to memory of 4520	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	90
PID 1248 wrote to memory of 4520	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	90
PID 1248 wrote to memory of 3396	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	91
PID 1248 wrote to memory of 3396	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	91
PID 1248 wrote to memory of 3396	1248	5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe	91

C:\Users\Admin\AppData\Local\Temp\5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe
"C:\Users\Admin\AppData\Local\Temp\5c1f6a9e3818afcc9a09e6a512738e281be7fdcfb86b0a109ec9f5f9d6db1f62.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
76eaed1cdcaa3e93de67dd5f94abb63e

SHA1
c0e0ff36484832ed8fd69b50fc2d2691811f218b

SHA256
fe485dd700b9b8c95e9de719dc1eb9ecf25b8f554fc23a3baa679ff12aa173b5

SHA512
bcf04a4f6e80db17fbb6d9be2b9c5722cd2118a6dbf4b2fc8a438efd8df1085fbc2a08047d1aaa909095f48294c2bb454ac66d76110deb6b6ec153b8a1a5511b

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
73KB

MD5
7173fa7120c9af65b3451c70ed748bd1

SHA1
6fd8dbabc5ecf6e256f5e5fcaa90b381a9d6ba43

SHA256
733e8f4e4b479ff52aac5608fe92ee5d4545be9df0a822c333a4d30e33067c9e

SHA512
e14ff97249c2fde3a759a3061329c8cdbe02247fc7ea34db0e3cc3236a97669d1bd9a6cf3cd5da76b36915955c4ed837af7d138de9941c0ba83ceb4ece8f1a74

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
df1c30d8b041949b904334b606f78e8b

SHA1
d4b4a3f165b5ec6e51151a7dd3361d3d435eb5d4

SHA256
57845c838b8276463a660736993a76bf337d7758afb9bc2602763e1aa5b1c0e3

SHA512
515adbf262dffa4ca95d414ed4b5c81a7817bfc1aa950d3542423335e7d59b28d45fcf3a9f51e750450fd0da05731562669338ab3b7548b8e873ec2097816a3a

Download Submit
memory/1248-0-0x0000000000EB0000-0x0000000000EDF000-memory.dmp

Filesize
188KB

Download
memory/1248-18-0x0000000000EB0000-0x0000000000EDF000-memory.dmp

Filesize
188KB

Download
memory/4520-13-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download
memory/4520-21-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download
memory/4520-23-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download
memory/4520-29-0x0000000000100000-0x000000000012F000-memory.dmp

Filesize
188KB

Download