urelas | 1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6

Analysis

max time kernel
92s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe
Size

48KB
MD5

d6bf5d60b44618978503a040a5532224
SHA1

d83131212352901df3140ea7c77e808c7bae9e8d
SHA256

1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6
SHA512

2be6ae1afc899dae34cddae9b53fae62993de67ff78dfb7d42c0a48fde3a20e6105ded37e6bcbbf8ae895311a1bbae265b08fef483ae0cb0d8a59b19c40787f9
SSDEEP

1536:Op4/PC7Ruz3hRXRASULZ6JKYdbzcm6lMPR9nE:Qt7R8fU6nWs3E

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe

Executes dropped EXE 1 IoCs

pid	Process
3688	okoser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	okoser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3688	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	82
PID 4048 wrote to memory of 3688	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	82
PID 4048 wrote to memory of 3688	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	82
PID 4048 wrote to memory of 1084	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	83
PID 4048 wrote to memory of 1084	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	83
PID 4048 wrote to memory of 1084	4048	1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe	83

C:\Users\Admin\AppData\Local\Temp\1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe
"C:\Users\Admin\AppData\Local\Temp\1426fa71c4361e62b95dd48e571bd9bc9de984823c11ad0023a830eb252c46c6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Local\Temp\okoser.exe
  "C:\Users\Admin\AppData\Local\Temp\okoser.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
0b43271388568b7282d66a2022f2bb0e

SHA1
695af294c1646f82e9c8a319d1650c272d461e2a

SHA256
773878c526d8643ae94343d9a082c0cc75596a3b1bdce71691010908d42cacc5

SHA512
1708dbd74eb867a0a1516ddc9e9edc06b2ec902695611ad0670ef1a706d9661344ed71c44cebed87146f85683d8742d42d9b1ede934ebad828191a045e131321

Download Submit
C:\Users\Admin\AppData\Local\Temp\okoser.exe

Filesize
49KB

MD5
9d940ae35ec09dcd175d62d8955184a6

SHA1
33da641f489c0af8753ba0c1f6521d976d52c2c4

SHA256
db003a30af8ac0969a93d9081c5e7502d4fd1eaa93b6c1def86ed41ff288cc5f

SHA512
115cc3353b70794399010b0bf32596dfdb7fc595a45835f69c8f873553c206d192b8e0e91cc59ae13586cbc0602f28ee291d5ecdd8a2d517cf5122d567d326c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
e0b5593673bbf0c0bc8591381c9d8546

SHA1
856cc2d283b74b3b83521d37556b685d795cdc3f

SHA256
aaf5d0f341f34766eb6d7b32a4519e2addd56ea4845378790e91800fbf0884c3

SHA512
2db0f8f262b1f90893d64d4fff8bb17292f9222af9516a18ada3566202637136e78ca5510a3e843ad81bdc495a4dcf5587a2f084d0e35edd36a441c49026f085

Download Submit
memory/3688-12-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download
memory/3688-18-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download
memory/3688-20-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download
memory/3688-27-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download
memory/4048-0-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download
memory/4048-14-0x00000000002F0000-0x0000000000323000-memory.dmp

Filesize
204KB

Download