urelas | cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742

General

Target

cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe
Size

80KB
MD5

90548919a9060797b4bf3759f29db290
SHA1

30dfc18f28dad95d0b97cbe80ea48b3c07c81062
SHA256

cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742
SHA512

5103f96f283fe5cb7a8f4bc0d0e60653ee721a7d7dca590d49d139e4fe86bc72742405a6fa82cd78ea6ce5eb542bc596eee6b4d8eda8d01cd9ce01cb63c5b3aa
SSDEEP

1536:zxKyhnAUfUiZR9G84qk+Be/HZ17hmZpDsxu1+:zLCEZTGx518ox6+

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
1508	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2780	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2780	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	30
PID 1448 wrote to memory of 2780	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	30
PID 1448 wrote to memory of 2780	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	30
PID 1448 wrote to memory of 2780	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	30
PID 1448 wrote to memory of 1508	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	31
PID 1448 wrote to memory of 1508	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	31
PID 1448 wrote to memory of 1508	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	31
PID 1448 wrote to memory of 1508	1448	cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe	31

C:\Users\Admin\AppData\Local\Temp\cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe
"C:\Users\Admin\AppData\Local\Temp\cb5fffbd700a1564046b19b3458cf4bcdc15760dcf402e4b906c9cc2b7082742N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
af6f90fee60d60070d9076eba7533c76

SHA1
015da84cb0cfce8699e8b1937dfac54a15e7e792

SHA256
14360d90f621ef9e1d84b269de67f782c9f6a904cf3226c2724d4898c157b687

SHA512
53ce60ef6f9dc9241d106d4e160833430e7855a221babf9835578096313a7a8ba1285df8d5620850ffe9f41f860e04e758a2f0be6fe688a87ea13d780234c3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
0b62976bf99d2f9373313c024031aefa

SHA1
5062ed629b77c90d1931317cce0b30e88216538f

SHA256
e74e59c265d39fc4a009a68032638a678115066d406a2a785f42cf35286bec1f

SHA512
f6b80270530273991f4e242c83548da6e835b2c40b395713ea097f18d494dad2f368ea8517756677c2b0cbde8208af982070e1171cca7e829c07a2e5d885aa40

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
80KB

MD5
d6986fc14e150a7573777a69c986c185

SHA1
9840236dd1e1089d7c2328e0c0dd2dee4e8c66cd

SHA256
7bb4bf57f24bf8df8bdfa6f87e152c4a442fad4eba8aa7ec41668c5a7c0f56b6

SHA512
daf201bb3564bfe0535b07339474abd88e215596ae31af263063dc888e6cef7e031d3c3a9fdc63e1b18991cb6207103afb45a3db59b19d560634aec1339c7812

Download Submit
memory/1448-0-0x0000000001360000-0x000000000138E000-memory.dmp

Filesize
184KB

Download
memory/1448-18-0x0000000000340000-0x000000000036E000-memory.dmp

Filesize
184KB

Download
memory/1448-17-0x0000000001360000-0x000000000138E000-memory.dmp

Filesize
184KB

Download
memory/1448-30-0x0000000000340000-0x000000000036E000-memory.dmp

Filesize
184KB

Download
memory/2780-19-0x0000000000F30000-0x0000000000F5E000-memory.dmp

Filesize
184KB

Download
memory/2780-22-0x0000000000F30000-0x0000000000F5E000-memory.dmp

Filesize
184KB

Download
memory/2780-29-0x0000000000F30000-0x0000000000F5E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing