urelas | 2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893

Analysis

max time kernel
93s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2024, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe
Size

76KB
MD5

9129d779c4975fcc69f62557550805ad
SHA1

90f8d859ce3787e7ea7e4f6bef112caf8954ba5a
SHA256

2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893
SHA512

d7233ef2f4f0e6131009d776d7c48bd0127d56ebc2d4b8803ef3462ec7a21438562b96ea79e71b8ed89a507fc797e817a8e25573e60255bc9acf8ff8a9fc1738
SSDEEP

1536:1D433Oe20lleqbmruXP+9E5KJ+e8XwhpfH:1Dcpl1mrE+EeBJff

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe

Executes dropped EXE 1 IoCs

pid	Process
4528	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	82
PID 2360 wrote to memory of 4528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	82
PID 2360 wrote to memory of 4528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	82
PID 2360 wrote to memory of 3528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	83
PID 2360 wrote to memory of 3528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	83
PID 2360 wrote to memory of 3528	2360	2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe	83

C:\Users\Admin\AppData\Local\Temp\2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe
"C:\Users\Admin\AppData\Local\Temp\2a9fef8b1d91672aec0a52828e4e5b1c6e9f24da364b8d1455e1daf1ec3e9893.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e9bde5b44e2cc18d88ff2ee2dbc7081c

SHA1
b2eba2136f52d53ff3f60541bc79e7b217d0b268

SHA256
53c25f3ea9f537bb7d5accae21cbc5c9ef83e4bdf52143201ab08b69403b489c

SHA512
573357570a89779fc2984dcc70639460bc8d0cfc6d3a0a37d0623a5804630e804b34671b0f98765b9f7a68b04aa550ffbfd9ca69f6157cff1c826466943bfc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
76KB

MD5
4355ae03b6fb26c2fccf94499da09417

SHA1
eb3d2cc5d33e9016e01d38dc154f9f90b90bb4e8

SHA256
0b2d2c8522137bebdd00fe40667e6484efaef2d65e8ba13eb5feba119e6d52fd

SHA512
228e3ccc7f9636636676afeb15529b3bff5774672a5261f4960551956264db91ccddf00e329c63420222d94034bbd097f2d4d730ffbc0ba8e51b91244f45651f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
541af4790ddf0f9cb8255bef868e5b9b

SHA1
1616b96073606d59c92562f67a2ed02120ee051e

SHA256
7d031ad5a2f1faf8e2a128f7b389e3b7a3e6d2d4d73d6dde76f7c4ba9bbd81e9

SHA512
0000f384309d9d746aebb152e28b7ebbf680086a004241da2d1f226b85eef6a4ee33ca7e5dd70cc01f98f1fe2396a63fd9cf36cba36ab8fc4cb65a83fa2835f1

Download Submit
memory/2360-0-0x00000000009F0000-0x0000000000A20000-memory.dmp

Filesize
192KB

Download
memory/2360-15-0x00000000009F0000-0x0000000000A20000-memory.dmp

Filesize
192KB

Download
memory/4528-10-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/4528-18-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/4528-20-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/4528-26-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download