urelas | 514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe
Size

51KB
MD5

57b846a6a331f151b127fe0c4a3a90f6
SHA1

33e3caedd0a30c5085446f5d38527caca05d8a16
SHA256

514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254
SHA512

af56559ddc4b887cd34039008e443d24d023e28e8e18596e9900a030fd7953c3e516cead58527280f120dbc9375435a7a2459c46f1dfd5776a5fd29c65d8bc6d
SSDEEP

1536:h+Ds6ClDXuqweo/0khAUnJDgabGsVy6umfFlPhP5:KsdXfBo/DBJBGzkP5P5

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe

Executes dropped EXE 1 IoCs

Processes:

shoste.exe

pid process

4440 shoste.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4440	shoste.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exeshoste.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shoste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe

description	pid	process	target process
PID 5084 wrote to memory of 4440	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	shoste.exe
PID 5084 wrote to memory of 4440	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	shoste.exe
PID 5084 wrote to memory of 4440	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	shoste.exe
PID 5084 wrote to memory of 444	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	cmd.exe
PID 5084 wrote to memory of 444	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	cmd.exe
PID 5084 wrote to memory of 444	5084	514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe
"C:\Users\Admin\AppData\Local\Temp\514cb875496dcf6bc5e35a95a11993a6cc951d3dcc123b284a9457d22c410254.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\shoste.exe
  "C:\Users\Admin\AppData\Local\Temp\shoste.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f51c1462254f3bb8aa00201af0b0a030

SHA1
60d3c892bb5c4f654c318451012f936d81164418

SHA256
695c02a7ab1d4a3bf5060ab1c7c63f651dc1fd945c0c5c3263c23db769f689c5

SHA512
41059643033b10394b1593371e22542e4b7f504a3da36ca2cdbf28521dd24bd70d70f42c99f580227e9799c64b5c23c7b9182ca518245b66eb831868e043e0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
1d476014c463a5af12fb21be0e094eba

SHA1
d5ab181cc5fa43f37a81cfbaaaf84603c6fa0122

SHA256
d81badbdc8c52df88e35daf9e58c2686c39db6918b3e34b7a3128fe93383f270

SHA512
02aeb4ebfe3bc709beec5313e30da015a393b928b27cf73fbc2e54b9d860db00711324f22a8db1541aa777ac4a82df5006dd221a8fd8e610d08f45bf2878db26

Download Submit
C:\Users\Admin\AppData\Local\Temp\shoste.exe

Filesize
51KB

MD5
59ef5ad9d294072a4ca9aa23d701acf6

SHA1
623c8ea5559e1e6ac6634f8a3dc4b483cbcf4001

SHA256
5698981d84d5c57d3a2b2e05bc10ad45053702ef6b80c1cca7afb5d76abeba5f

SHA512
6f01dee4b26336d65753a5b62a576bb74749470fa699c1dd25a948e48844108ed67a32b97a3f626fdcb4868cd1de971d6772022ba9a2fc86b5b1ea2142d9ac1e

Download Submit
memory/4440-12-0x0000000000320000-0x0000000000355000-memory.dmp

Filesize
212KB

Download
memory/4440-18-0x0000000000320000-0x0000000000355000-memory.dmp

Filesize
212KB

Download
memory/4440-25-0x0000000000320000-0x0000000000355000-memory.dmp

Filesize
212KB

Download
memory/5084-0-0x00000000005A0000-0x00000000005D5000-memory.dmp

Filesize
212KB

Download
memory/5084-15-0x00000000005A0000-0x00000000005D5000-memory.dmp

Filesize
212KB

Download