urelas | 8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0

Analysis

max time kernel
102s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe
Size

80KB
MD5

c61565bc7821ad31575c98837e352d30
SHA1

370dee5fcef1eb0171744ed59ab3212ca1ff7a70
SHA256

8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0
SHA512

cd0299653aafc74def46f0d49a56d08e747766b2d60686d985a6cbf65431a45bc918aeb7d3b3b24aaa28c15929af28df40df3ff1f30e917ba7a54fb36d0d74fe
SSDEEP

1536:UOzC0tKyIy9nOM8e5rqYJkdpzCEw2dnU4qv8m:UO9Ro2rqYyXzCEwG2

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe

Executes dropped EXE 1 IoCs

pid	Process
5004	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 5004	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	90
PID 3432 wrote to memory of 5004	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	90
PID 3432 wrote to memory of 5004	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	90
PID 3432 wrote to memory of 2252	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	91
PID 3432 wrote to memory of 2252	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	91
PID 3432 wrote to memory of 2252	3432	8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe	91

C:\Users\Admin\AppData\Local\Temp\8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe
"C:\Users\Admin\AppData\Local\Temp\8f07bd77f8adbdc6d60691f48f8d23c27aa3e0cbfefcb34a45fb5fb9969896b0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6e0ecec5e285ac121f1bf7f3a59ce016

SHA1
d432c8dd0bd3ddfffaa5a22a74c6da08172c13d7

SHA256
c1df717fda579031c64433ccadbc1e471654b843121f07f4066b7793355e2dfe

SHA512
9c20f07807c92a4bd1808deb68e571fd0ea26f39b6033c8f9e40c0346267aae396ba4ceac427c2daf95d855cca22f05aaeb7ad4f93bd8289972816a55d69527d

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
80KB

MD5
0ba86e384acc90d707a8c459b1d110e5

SHA1
4f408098efc23a957d766e3dfb825a765bec59a4

SHA256
fd9578d16c18dd95220f7c223155ce8ccea078ef15013001e4d4d2b10c7b0733

SHA512
9c304c79300d2a7b4787563f5691a018e40cb6c2c06d0e0e9af0814a64df25242bb16ca2c3624b2b0d86b3a335f26963453f1ce24b46cba8ed7da55053490ea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
da74a59a7582ff592cf4feee5fdd5457

SHA1
c486425f357e50172dd3d4b9f1de81464367fc7c

SHA256
d28a696ed5ba3e53d1c209910a70ed0ceb6c60849282c3dda6179272df11c9a1

SHA512
8fc309d0a3d524b52cde0b16a8e006b6167bfe3d55d394c751d813bc6ce772b3937ee551b1ffda612007c62ba9ff6775cc8c3fb832d651676ffea6fdde334a56

Download Submit
memory/3432-0-0x0000000000020000-0x000000000005C000-memory.dmp

Filesize
240KB

Download
memory/3432-15-0x0000000000020000-0x000000000005C000-memory.dmp

Filesize
240KB

Download
memory/5004-10-0x00000000003D0000-0x000000000040C000-memory.dmp

Filesize
240KB

Download
memory/5004-18-0x00000000003D0000-0x000000000040C000-memory.dmp

Filesize
240KB

Download
memory/5004-20-0x00000000003D0000-0x000000000040C000-memory.dmp

Filesize
240KB

Download
memory/5004-27-0x00000000003D0000-0x000000000040C000-memory.dmp

Filesize
240KB

Download