urelas | 83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
Size

77KB
MD5

ba5966e7a7005c0fe037d9db80ea7b34
SHA1

9233b4ba19c3dc77b14f5ed5121df173680c1964
SHA256

83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368
SHA512

5dc8c6d4ba70e887d0b5fc3babfcde45feae30c9caa521ed0e64ba9a614fd48d06a07d732378ddc9203be963a0073fe753b994d09334383a62ea1cfffe211d44
SSDEEP

1536:1D433Oe20lleqbmruXP+9E5KJ+e8XwhpfB:1Dcpl1mrE+EeBJfZ

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe

Executes dropped EXE 1 IoCs

pid	Process
4140	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4140	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 1448 wrote to memory of 4140	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 1448 wrote to memory of 4140	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	82
PID 1448 wrote to memory of 2276	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83
PID 1448 wrote to memory of 2276	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83
PID 1448 wrote to memory of 2276	1448	83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe	83

C:\Users\Admin\AppData\Local\Temp\83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe
"C:\Users\Admin\AppData\Local\Temp\83e4ddcce6648da1af93d068a4ea079b7ac1de84fdb2f586ac2bd01f5fdc9368.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e9bde5b44e2cc18d88ff2ee2dbc7081c

SHA1
b2eba2136f52d53ff3f60541bc79e7b217d0b268

SHA256
53c25f3ea9f537bb7d5accae21cbc5c9ef83e4bdf52143201ab08b69403b489c

SHA512
573357570a89779fc2984dcc70639460bc8d0cfc6d3a0a37d0623a5804630e804b34671b0f98765b9f7a68b04aa550ffbfd9ca69f6157cff1c826466943bfc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
77KB

MD5
46830b04f8e26ac6bdf5e5da22a8af1e

SHA1
e72ef43156af7902cd7a54105bde157dbff98e84

SHA256
f2c98dbeeac5063e82939f3d44ff1c5df258356d1f14a2263e57ac4ea391573a

SHA512
4467b11b1ddd785ee19917660375c7e95ab43f0a19cc98361d49bd7f78c4d57aec0c1d701c573c8618584959523857faf738e21ad24614207f0edb8b9f88b1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
e96eb534e1cff54c3f55ea24a94c10c6

SHA1
52fbcd8b78a7c75acc4a5bf0d5950a06241d309b

SHA256
1d8a9d8c12439a987fc2949abd11551c41c167ecfc14facb158a118a3fb1d8e3

SHA512
8c926f44ec3686e8a3fe973d93166cec7dba04ec3f57dd043ea881c968417ff0194bf73391de74ae00213c8968743e774e970897356b9e3f4e04198ffe483b81

Download Submit
memory/1448-0-0x0000000000AA0000-0x0000000000AD0000-memory.dmp

Filesize
192KB

Download
memory/1448-14-0x0000000000AA0000-0x0000000000AD0000-memory.dmp

Filesize
192KB

Download
memory/4140-11-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download
memory/4140-17-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download
memory/4140-19-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download
memory/4140-25-0x0000000000160000-0x0000000000190000-memory.dmp

Filesize
192KB

Download