urelas | 74f3e19d9f4c1668fcddbceb89f140896bdef0e1c5ba40fc3ebe1a88d60e07d8

General

Target

e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe
Size

80KB
MD5

5e7c4c9d7dbbc3601f778e9a088e712a
SHA1

527cb4ad8b95774fc4b8e32dc8ce54ce714d4b28
SHA256

74f3e19d9f4c1668fcddbceb89f140896bdef0e1c5ba40fc3ebe1a88d60e07d8
SHA512

b67118b2d24b8c81c15aabd3774f65a6b221f751c8b1effa90f1299f644721d2101e775a05052c05988ebc6d2613a1e97973835072e3c21b905137addee20111
SSDEEP

1536:UOzC0tKyIy9nOM8e5rqYJkdpzCEw2dnU4qvC:UO9Ro2rqYyXzCEwG/

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

5052 huter.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5052	huter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exee5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exehuter.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe

description	pid	process	target process
PID 2800 wrote to memory of 5052	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	huter.exe
PID 2800 wrote to memory of 5052	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	huter.exe
PID 2800 wrote to memory of 5052	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	huter.exe
PID 2800 wrote to memory of 2024	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	cmd.exe
PID 2800 wrote to memory of 2024	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	cmd.exe
PID 2800 wrote to memory of 2024	2800	e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe
"C:\Users\Admin\AppData\Local\Temp\e5bc7b98e37ad707d75987e18042c45b0e2ab54ffd1196c4a6dcead24dcf8825N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6e0ecec5e285ac121f1bf7f3a59ce016

SHA1
d432c8dd0bd3ddfffaa5a22a74c6da08172c13d7

SHA256
c1df717fda579031c64433ccadbc1e471654b843121f07f4066b7793355e2dfe

SHA512
9c20f07807c92a4bd1808deb68e571fd0ea26f39b6033c8f9e40c0346267aae396ba4ceac427c2daf95d855cca22f05aaeb7ad4f93bd8289972816a55d69527d

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
80KB

MD5
8dc08f6cf28c077d68395f47eeda8cca

SHA1
725c9b6022264c7cdd1690198de7cbc09a59d7a0

SHA256
04acc36fcb57d458c1302053458f91b135b9f9465ab8c6e45d63198c012536e7

SHA512
58d27c08946865503999801ff2c2f1d86fb24517bb74319d15ad1d54bfd92ce0b98716b03a684cecfd462aa68cd3b0d61503c5ee2d2024cd37ad72743f32db78

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
8471d90b01e4173ed8a405cd60089527

SHA1
6790e403ffa6e21d8aa7ea0e0cd56240236a13c7

SHA256
60e98618e64ec87d17251463f53d29c096a6c3ba128274549a60dd2866d0e848

SHA512
437ef6d9ac895ac1d88794ca31bd1bd23369108c5edf9a1a70c294463a4efc81ff669eba4c46da9e010d204ae96ada714c8d358e2bfd96807c25dac0dd807061

Download Submit
memory/2800-0-0x00000000003E0000-0x000000000041C000-memory.dmp

Filesize
240KB

Download
memory/2800-15-0x00000000003E0000-0x000000000041C000-memory.dmp

Filesize
240KB

Download
memory/5052-10-0x0000000000950000-0x000000000098C000-memory.dmp

Filesize
240KB

Download
memory/5052-18-0x0000000000950000-0x000000000098C000-memory.dmp

Filesize
240KB

Download
memory/5052-20-0x0000000000950000-0x000000000098C000-memory.dmp

Filesize
240KB

Download
memory/5052-26-0x0000000000950000-0x000000000098C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads