urelas | 83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
Size

77KB
MD5

ba5966e7a7005c0fe037d9db80ea7b34
SHA1

9233b4ba19c3dc77b14f5ed5121df173680c1964
SHA256

83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368
SHA512

5dc8c6d4ba70e887d0b5fc3babfcde45feae30c9caa521ed0e64ba9a614fd48d06a07d732378ddc9203be963a0073fe753b994d09334383a62ea1cfffe211d44
SSDEEP

1536:1D433Oe20lleqbmruXP+9E5KJ+e8XwhpfB:1Dcpl1mrE+EeBJfZ

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2948	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 4120 wrote to memory of 2948	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 4120 wrote to memory of 2948	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 4120 wrote to memory of 60	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83
PID 4120 wrote to memory of 60	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83
PID 4120 wrote to memory of 60	4120	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83

C:\Users\Admin\AppData\Local\Temp\83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
"C:\Users\Admin\AppData\Local\Temp\83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e9bde5b44e2cc18d88ff2ee2dbc7081c

SHA1
b2eba2136f52d53ff3f60541bc79e7b217d0b268

SHA256
53c25f3ea9f537bb7d5accae21cbc5c9ef83e4bdf52143201ab08b69403b489c

SHA512
573357570a89779fc2984dcc70639460bc8d0cfc6d3a0a37d0623a5804630e804b34671b0f98765b9f7a68b04aa550ffbfd9ca69f6157cff1c826466943bfc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
77KB

MD5
631875d97bd91b8313d39c945718b134

SHA1
d97a7a4509565e0a135dee5fc4c9b2166d4353cf

SHA256
b49979533b04dc7d46b1e9892ed2b6d54f68e2fb51f05eaecd4775ed11dc058f

SHA512
a92559925de10257179300d352c203ebf74e1c90824ad7f58141cd58e0e030dba4255e9bad7718258ded4652128b9a6b4cac60b1174d3768b82209ab25f530de

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
e96eb534e1cff54c3f55ea24a94c10c6

SHA1
52fbcd8b78a7c75acc4a5bf0d5950a06241d309b

SHA256
1d8a9d8c12439a987fc2949abd11551c41c167ecfc14facb158a118a3fb1d8e3

SHA512
8c926f44ec3686e8a3fe973d93166cec7dba04ec3f57dd043ea881c968417ff0194bf73391de74ae00213c8968743e774e970897356b9e3f4e04198ffe483b81

Download Submit
memory/2948-11-0x0000000000180000-0x00000000001B0000-memory.dmp

Filesize
192KB

Download
memory/2948-18-0x0000000000180000-0x00000000001B0000-memory.dmp

Filesize
192KB

Download
memory/2948-20-0x0000000000180000-0x00000000001B0000-memory.dmp

Filesize
192KB

Download
memory/2948-27-0x0000000000180000-0x00000000001B0000-memory.dmp

Filesize
192KB

Download
memory/4120-0-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download
memory/4120-15-0x0000000000490000-0x00000000004C0000-memory.dmp

Filesize
192KB

Download