urelas | e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe
Size

138KB
MD5

ba2e877d4d5faeef6fcfd92994b8023e
SHA1

3da68acf410cc9fbbda12b3a7a58f19d6e528b2d
SHA256

e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c
SHA512

be93f12bd639fc8d3442dcd723f78b4379647afd9ecdbe1fb8c1a81bc9ddc003504702d008b880c5d36a7fa2e6a48a283670ca09a0fa01c0dabf0cb02ef9b1d8
SSDEEP

3072:VUhMsp+K1OXZjftqRO6DL/qHR4oBvsA7Ipr308dU4GE:VUhAOOt84Rh9KEi2E

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2040	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	83
PID 1344 wrote to memory of 2040	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	83
PID 1344 wrote to memory of 2040	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	83
PID 1344 wrote to memory of 4536	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	85
PID 1344 wrote to memory of 4536	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	85
PID 1344 wrote to memory of 4536	1344	e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe	85

C:\Users\Admin\AppData\Local\Temp\e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe
"C:\Users\Admin\AppData\Local\Temp\e8fd0c8223bc07010f1212460f50c174112200f5298b34f7d8747bb5166a1d0c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a2de452e45db47c817b5ada178bd2e83

SHA1
44b16b5c0e400a2af95299d0c08a6a4fda14bc4c

SHA256
516ba3f510ebfd821b47f63ac2c47faa15d5f2ba8732c79c0265fa8aa3ad8fd4

SHA512
8799d95d502764a4266c37c1c5fbb24fb9ab94983310962deafd5e246c5900993dffb2c2b06ab6709cc4141aab3346a9cf65b2a62744dbf11c7d381af654be85

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
138KB

MD5
1199eb5eb2f5c21bda6d8c0d24ae39dd

SHA1
4dc72827d1844ee612a233165376cfcb7867ab4a

SHA256
768b6535d8c85b6c5961d53da368b456ea0b77ec80eeb484c537f5583c3e5e3c

SHA512
d230fe8dbf4e8e2dd574a85443dfb5dcd7a70d739ea999563f3f446884de697f4d90a8df55849f35de2efe111ae2b0a25bfa10ea84b7b431e85c0c55e26650ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
afb8e30340f8addee33b1b847effa25e

SHA1
a3165183a204842b451df77ba2895764b6297fd3

SHA256
fe44a1b64422e348ee1238151531a2c7698f36d6c7caa821e6ea3cff3b1a34ff

SHA512
d8435aea1bea9cd7abc9a4418eb55a1cb6b8dd0bc81acc240988f5b8f2b54871210d19261e5c623056bfaba55b871f7f236a4219e0085bf6e103fed67dd7c5ac

Download Submit
memory/1344-0-0x00000000007B0000-0x00000000007FD000-memory.dmp

Filesize
308KB

Download
memory/1344-1-0x00000000007FC000-0x00000000007FD000-memory.dmp

Filesize
4KB

Download
memory/1344-17-0x00000000007B0000-0x00000000007FD000-memory.dmp

Filesize
308KB

Download
memory/2040-14-0x000000000055C000-0x000000000055D000-memory.dmp

Filesize
4KB

Download
memory/2040-12-0x0000000000510000-0x000000000055D000-memory.dmp

Filesize
308KB

Download
memory/2040-20-0x0000000000510000-0x000000000055D000-memory.dmp

Filesize
308KB

Download
memory/2040-22-0x0000000000510000-0x000000000055D000-memory.dmp

Filesize
308KB

Download
memory/2040-28-0x0000000000510000-0x000000000055D000-memory.dmp

Filesize
308KB

Download