urelas | 4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa

General

Target

4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe
Size

81KB
MD5

83888add65cf0ecdf0fc03368a63b63b
SHA1

ddfc6b45194d09f2df0d0e6b811bda19ce3538b5
SHA256

4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa
SHA512

c98d81ed41707d179e90391df769c02b2d2cd58269b1fefb8f2e3efcfa70dc19ee7001f39e67b9c2a5f3299ab17d3bfa4460707a5bb291382a68e18298582c25
SSDEEP

1536:zxKyhnAUfUiZR9G84qk+Be/HZ17hmZpDsxu1o:zLCEZTGx518ox6o

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2200	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1224	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1224	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	31
PID 1768 wrote to memory of 1224	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	31
PID 1768 wrote to memory of 1224	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	31
PID 1768 wrote to memory of 1224	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	31
PID 1768 wrote to memory of 2200	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	32
PID 1768 wrote to memory of 2200	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	32
PID 1768 wrote to memory of 2200	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	32
PID 1768 wrote to memory of 2200	1768	4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe	32

C:\Users\Admin\AppData\Local\Temp\4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe
"C:\Users\Admin\AppData\Local\Temp\4d9c0e68d2af1cfaf45eef58ab6dbbbf635b2e8069cc18abf97b0033204a01fa.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
af6f90fee60d60070d9076eba7533c76

SHA1
015da84cb0cfce8699e8b1937dfac54a15e7e792

SHA256
14360d90f621ef9e1d84b269de67f782c9f6a904cf3226c2724d4898c157b687

SHA512
53ce60ef6f9dc9241d106d4e160833430e7855a221babf9835578096313a7a8ba1285df8d5620850ffe9f41f860e04e758a2f0be6fe688a87ea13d780234c3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
a8b3c3f424af2e292bdcf3b8725fd712

SHA1
c2c6e83c5c8676e03360c27a129139baa010d90c

SHA256
c972db70c5fb12749a832b01918f015675f606874507b6ab35627c2626364a52

SHA512
f98beea8d7ce768967044a7c73df79af809acbbb87c74cb777b9f3675ab31d3b348bab87abb8fe0903d620132d304ab5742de6863a65f418a8c8038870d8d09b

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
81KB

MD5
f1e16e9138fb3513c7f7274c69afe328

SHA1
b0a33c9e18cfb9dd635945f9f1a8135001e50cfa

SHA256
67832f352566407b9f428e5972168b295d4f1e3f015c7e7c50aee3c27714a264

SHA512
aca85b96d771900dca8a15b5c6b6add1a52fec53e98532ebf29e69bf44e4ad8e27019db0dec9dc1e574b581fed1e1d1c49909143c1a851cfdaacb3b1696522a2

Download Submit
memory/1224-21-0x0000000000220000-0x000000000024E000-memory.dmp

Filesize
184KB

Download
memory/1224-28-0x0000000000220000-0x000000000024E000-memory.dmp

Filesize
184KB

Download
memory/1768-0-0x00000000001A0000-0x00000000001CE000-memory.dmp

Filesize
184KB

Download
memory/1768-6-0x0000000001D60000-0x0000000001D8E000-memory.dmp

Filesize
184KB

Download
memory/1768-18-0x00000000001A0000-0x00000000001CE000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing