urelas | 528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe
Size

93KB
MD5

1a0600b707b4259f0e20a55ef1ef5175
SHA1

7df8c2784b1d221848419b7fefdc461207fc5aa3
SHA256

528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c
SHA512

da6579af3ddf1f72582206c98f5204d8531fb0a57e6a87cc00b76082ff8c22b993ff250601da2956349f6fb39ff1f25acd54d271842d998100052f43ff880d45
SSDEEP

768:tp0ti4HnnhtwYbJy6rioyelmd1TzulQEDDPOwc5n5uNCT/jhhLBxQIwqepJZU9m+:tWzhtJbUgHoADDIx1hLfuJr+

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe

Executes dropped EXE 1 IoCs

pid	Process
4920	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4920	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	82
PID 5020 wrote to memory of 4920	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	82
PID 5020 wrote to memory of 4920	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	82
PID 5020 wrote to memory of 3712	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	83
PID 5020 wrote to memory of 3712	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	83
PID 5020 wrote to memory of 3712	5020	528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe	83

C:\Users\Admin\AppData\Local\Temp\528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe
"C:\Users\Admin\AppData\Local\Temp\528a01c489ede33b80523126e4d4a885ae495cd290a8eceb3821faf0982e942c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
16c2bcf1dae729c5cb36a1875efe354c

SHA1
775fbf4b6a2e5bc033b86cfc0893250b5d387a45

SHA256
796a881d71234f7fcd9f5220c6e5674e231610bbf37626d9e5b79dc3268b7bb4

SHA512
d8bd6cb6cb6ccd3c2cc40edde9cd3e8c09d1ae55c21ac1896325c324c08507e68c16d3864923806d29db79c57b958dac68e43bdcf809c0a2c8b5b0a7b8557177

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
93KB

MD5
ab8e712d0552c911deb57af4cedbc514

SHA1
7a1699335a9b808cfcbeeaa6f47ec60d24769271

SHA256
1210e56077517511e1ff1116fa0d891e5e787e5a18764aa89e4d03d0a6a0bf4f

SHA512
6020367b32d22e914b803eded05b85398cedb4ab2bb20e41b4f55c9824a20bfdf68b998d3ab61e765b45b63bc88e12904401f470bd82ad38634e479b35ed7a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
902fecc50b6a254a99a7ac681ade05d0

SHA1
ab6cdade8a9bc0aa83bda769b3a2ad4d145c778c

SHA256
10503dd8e33a25f7cc77f5cd118b64790d386ffa1528fed8d8e0067ac4e34b01

SHA512
c84a7ebe25a6cf69e3f0a2e13238695c3dd5333b7a5a2a4711e22058e0fba9e6d414dedc1a9e48923bcca8dac9e0ad525c7351b8105759896a847c4bab95114c

Download Submit
memory/4920-12-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/4920-18-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/4920-20-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/4920-26-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Filesize
192KB

Download
memory/5020-0-0x0000000000980000-0x00000000009B0000-memory.dmp

Filesize
192KB

Download
memory/5020-15-0x0000000000980000-0x00000000009B0000-memory.dmp

Filesize
192KB

Download