urelas | 663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2

Analysis

max time kernel
92s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe
Size

51KB
MD5

44cce61aef1505565c26b5a6a4feb431
SHA1

8d0055e802ca471807788767931b878f555133c5
SHA256

663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2
SHA512

0de33dc74e5bf058dd957e5453f4443df04672c08ec2e5138e0a83403fa7ea39893948ce8b673878b609c2ce8537aa14bacb61ed9abde3fc8982223cfd357582
SSDEEP

1536:h+Ds6ClDXuqweo/0khAUnJDgabGsVy6umfFlPhj:KsdXfBo/DBJBGzkP5j

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe

Executes dropped EXE 1 IoCs

pid	Process
5028	shoste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shoste.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 5028	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	87
PID 1196 wrote to memory of 5028	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	87
PID 1196 wrote to memory of 5028	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	87
PID 1196 wrote to memory of 1884	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	88
PID 1196 wrote to memory of 1884	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	88
PID 1196 wrote to memory of 1884	1196	663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe	88

C:\Users\Admin\AppData\Local\Temp\663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe
"C:\Users\Admin\AppData\Local\Temp\663a4dd3a5a074e4f1a0fbaa37f39d7d3c3b3444c1aa2c85fa72d6fae0f5caa2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\shoste.exe
  "C:\Users\Admin\AppData\Local\Temp\shoste.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f51c1462254f3bb8aa00201af0b0a030

SHA1
60d3c892bb5c4f654c318451012f936d81164418

SHA256
695c02a7ab1d4a3bf5060ab1c7c63f651dc1fd945c0c5c3263c23db769f689c5

SHA512
41059643033b10394b1593371e22542e4b7f504a3da36ca2cdbf28521dd24bd70d70f42c99f580227e9799c64b5c23c7b9182ca518245b66eb831868e043e0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c34a605c7fc89c3a036a01db1bb75eab

SHA1
4b04205514d3033bb98d9ff3d3663d99ff01603a

SHA256
9cbdf4a6605486d21a5de54741559c5c7eef6e3fcbc0952287692d4c06223a70

SHA512
dda0f164b98918defbbf353e7cded04a504b98ee8f0e2a9f26656b27d78e4bdb242b3e0039cc4999425ce2a90a1c6958f38fb175d40f1e357d8cc9f6a247a2b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\shoste.exe

Filesize
51KB

MD5
1b3cf37fd39fb0289022c2aabf40ac2c

SHA1
7733b9c9c32b886c962c21d13502aa4f6cdc33bf

SHA256
a26b8c929d383ba9aebde553ddb2d75f76bff23d3ab7ccfb06993cde86430afa

SHA512
1c5cdf88a1e7eaa608290e8d4108ce69baccfd54580e5c6046a3220f65ef1394308ff2f44b8d17d0d5283e98bc26ffa383ea115fd0b0fbb04b0645de2fdb1102

Download Submit
memory/1196-0-0x0000000000C50000-0x0000000000C85000-memory.dmp

Filesize
212KB

Download
memory/1196-15-0x0000000000C50000-0x0000000000C85000-memory.dmp

Filesize
212KB

Download
memory/5028-12-0x0000000000680000-0x00000000006B5000-memory.dmp

Filesize
212KB

Download
memory/5028-18-0x0000000000680000-0x00000000006B5000-memory.dmp

Filesize
212KB

Download
memory/5028-25-0x0000000000680000-0x00000000006B5000-memory.dmp

Filesize
212KB

Download