urelas | 7b7861b8fd660d916ceaab223f147b8fc7a391d36b53df6edf3133ba2f7a6d61

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe
Size

4.7MB
MD5

bc3c88404d4409b597b534093153f9c9
SHA1

7c7d487d5c749e8d9d906e8a01b4b8092f457991
SHA256

7b7861b8fd660d916ceaab223f147b8fc7a391d36b53df6edf3133ba2f7a6d61
SHA512

a0b5e5d3fd4ec2a0c95ec3934993155c597fef26ee07d49d15f3e8ae0ad6c4cc409c551bfc20f5e2bae738033d889a39836f23a748c1b57d45fc1bbd44ac7be5
SSDEEP

49152:a2V7djp+oE2ZjHoZB6EZ88JUUXIEABMRviTURcV:a2V7NpW6Y6joUh

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.30.235

121.88.5.181

112.223.217.101

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2088	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

sander.exectfmom.exe

pid	Process
2452	sander.exe
3020	ctfmom.exe

Loads dropped DLL 2 IoCs

Processes:

2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exesander.exe

pid	Process
3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe
2452	sander.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sander.exectfmom.exe2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sander.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ctfmom.exe

pid	Process
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe
3020	ctfmom.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exesander.exe

description	pid	Process	procid_target
PID 3040 wrote to memory of 2452	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	31
PID 3040 wrote to memory of 2452	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	31
PID 3040 wrote to memory of 2452	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	31
PID 3040 wrote to memory of 2452	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	31
PID 3040 wrote to memory of 2088	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	32
PID 3040 wrote to memory of 2088	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	32
PID 3040 wrote to memory of 2088	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	32
PID 3040 wrote to memory of 2088	3040	2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe	32
PID 2452 wrote to memory of 3020	2452	sander.exe	34
PID 2452 wrote to memory of 3020	2452	sander.exe	34
PID 2452 wrote to memory of 3020	2452	sander.exe	34
PID 2452 wrote to memory of 3020	2452	sander.exe	34

C:\Users\Admin\AppData\Local\Temp\2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-23_bc3c88404d4409b597b534093153f9c9_magniber_qakbot.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\ctfmom.exe
    "C:\Users\Admin\AppData\Local\Temp\ctfmom.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

Filesize
331B

MD5
4ad78f3d92e4ad3f81d399d9175e7c0f

SHA1
3a401a8f14f48ef7390331a9c5fe0a3ef4e1d08c

SHA256
85a3ea72a4d42ec84b396045879eb6cf102ec59c7d11faf669baf6743802583b

SHA512
77ad46305c70a0d71da3c200644c8daaf9075e30330202265170298507bd1f80363a6f2be9334043c5e348e94a0bd9ef6f8d95396af50f74ea302f34ba427ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctfmom.exe

Filesize
221KB

MD5
6ceb05ea8f66c5ab5f3975a118ff0f5c

SHA1
e9e57c1d944f37467588945af52b7d3381887930

SHA256
9bc40205cd8e52f8403ee1dbf1bc0ac353873519190ed388db4afb43d89b38d1

SHA512
da82ed4ea4766df8705e520fcda0011fa5a5750a1854c1227518593a05f72da3d4a1c8b758c453c2f48618f94325fded83d20fe86dd53105323c52f975a0d443

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
04113afab96ff36e7da4cabf336079cf

SHA1
2ab6a01f123c1ef4227cb134612749b67a237bf6

SHA256
8b3cc0c31002ffa60f497966a671ff1c0a23a6efa831bd2be2cfbee7588bac16

SHA512
68358e6ae577e59dd540c31d4cfcf56968d9b84416ffcd527867711165d78a9f351da0bf41afab96107b1dc736467b092f5b79be2b8f7f96f6871e4a0b5472e9

Download Submit
\Users\Admin\AppData\Local\Temp\sander.exe

Filesize
4.7MB

MD5
ad0c29ea26c8efdd9b6e21c7199264b1

SHA1
4185b9145a1a1234e65c201201f2ebd29a81be42

SHA256
f575405952d1999588c76a0b0ca1f88abe536ae8d5dcfcc8ff48ba31011efbfa

SHA512
80a5c64955c018fd4a02e5ce0b18bb095922e52555bf4db5a2a76527cb68776bdcf294f0f796db6507271e12eec5e7e240ccd0937492d2b80c1df10b5f607fe1

Download Submit
memory/2452-17-0x0000000001060000-0x0000000001543000-memory.dmp

Filesize
4.9MB

Download
memory/2452-27-0x0000000003470000-0x0000000003511000-memory.dmp

Filesize
644KB

Download
memory/2452-29-0x0000000001060000-0x0000000001543000-memory.dmp

Filesize
4.9MB

Download
memory/2452-21-0x0000000001060000-0x0000000001543000-memory.dmp

Filesize
4.9MB

Download
memory/3020-36-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-30-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-31-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-34-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-35-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-37-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-38-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-39-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-40-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3020-41-0x0000000000A00000-0x0000000000AA1000-memory.dmp

Filesize
644KB

Download
memory/3040-19-0x0000000000F60000-0x0000000001443000-memory.dmp

Filesize
4.9MB

Download
memory/3040-8-0x0000000003D50000-0x0000000004233000-memory.dmp

Filesize
4.9MB

Download
memory/3040-0-0x0000000000F60000-0x0000000001443000-memory.dmp

Filesize
4.9MB

Download