urelas | a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71

General

Target

a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe
Size

81KB
MD5

eea37dc012a4d62d0fc0248f80667f6e
SHA1

0de8b0368e89ba25bde508ee7149618ae78ff8bc
SHA256

a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71
SHA512

44dcdb6d516bc48e99b08a89fdbcae649eac0a7353ed6f39054b4705b94e1fc26f1e8c8bf12e4455caba4227c198238e861d0d27b9ba0688b9a1cf5b68beabf0
SSDEEP

1536:zxKyhnAUfUiZR9G84qk+Be/HZ17hmZpDsxu13:zLCEZTGx518ox63

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2776	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2728	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	30
PID 3068 wrote to memory of 2728	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	30
PID 3068 wrote to memory of 2728	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	30
PID 3068 wrote to memory of 2728	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	30
PID 3068 wrote to memory of 2776	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	31
PID 3068 wrote to memory of 2776	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	31
PID 3068 wrote to memory of 2776	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	31
PID 3068 wrote to memory of 2776	3068	a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe	31

C:\Users\Admin\AppData\Local\Temp\a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe
"C:\Users\Admin\AppData\Local\Temp\a9ea99ba9c236d5cdf10b28ffdfd5d80d5bbe18968456a90730566de13747c71.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
af6f90fee60d60070d9076eba7533c76

SHA1
015da84cb0cfce8699e8b1937dfac54a15e7e792

SHA256
14360d90f621ef9e1d84b269de67f782c9f6a904cf3226c2724d4898c157b687

SHA512
53ce60ef6f9dc9241d106d4e160833430e7855a221babf9835578096313a7a8ba1285df8d5620850ffe9f41f860e04e758a2f0be6fe688a87ea13d780234c3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
6f1eb2cfc9272c8088ee4c3fbcba882b

SHA1
96320a15c8e4b6fab8f3c4262cb6240204407098

SHA256
b90e78ddf648f328c780a47110b7dfcf6c72bcc9dc1c067a78ceb8950fe10898

SHA512
b46fbcf8b615f2979f06ca5d1bd2daa86086765487fa804729c8735a3eae379280d16ae2f7ce316607428ade29cf9f299719960a1ec4b2970c81a9702171cae5

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
81KB

MD5
44a988554fda850c29b980c2c61da0a1

SHA1
386d4935c05a19da72e7d70bb0ebec2f302eda44

SHA256
8df1c667c293e2a40959d1ee426901d98d3a7335b7b96238a86dcd8a046219da

SHA512
8c88a287e67f1d9dad9261b9a25b2e1343aa7c14d2007e981776929f398e200afe7eedb281be32014ac82127159556c120fb5a9a964d3075564b3d16a83fbbce

Download Submit
memory/2728-10-0x0000000000FD0000-0x0000000000FFE000-memory.dmp

Filesize
184KB

Download
memory/2728-21-0x0000000000FD0000-0x0000000000FFE000-memory.dmp

Filesize
184KB

Download
memory/2728-27-0x0000000000FD0000-0x0000000000FFE000-memory.dmp

Filesize
184KB

Download
memory/3068-0-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download
memory/3068-6-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/3068-18-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing