urelas | 57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
Size

80KB
MD5

9fe7296e75e0c51c0820d92acd13db8a
SHA1

2b66c697c8d54a69bf10d11c1a30e1ebad23b552
SHA256

57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd
SHA512

6ccfb426e711d0834a8829f8dbc369fe83128d6e52c56882bf3cf95bee7cdc27d89639f424e34ffa32145a3063b52943e6c2d0510239b8927cb6024f8bed8f4f
SSDEEP

1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te7s:4lnhYPlVMqmyAFIRRes

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe

Executes dropped EXE 1 IoCs

pid	Process
4648	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4648	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	84
PID 4600 wrote to memory of 4648	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	84
PID 4600 wrote to memory of 4648	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	84
PID 4600 wrote to memory of 2164	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	85
PID 4600 wrote to memory of 2164	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	85
PID 4600 wrote to memory of 2164	4600	57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe	85

C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe
"C:\Users\Admin\AppData\Local\Temp\57e7b537892e5992df2683f9928aa13087f10a1f464284d7ec65fb01107ad8fd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
dd1155cbc9956e5dbeee97b18e3c4c5a

SHA1
e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

SHA256
53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

SHA512
1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
80KB

MD5
6bba7b9d434948484c57c24e9a1910a2

SHA1
445e6d0c5447a54cbf34f35b442357f178eea189

SHA256
6dfc8d8627c2f6458405c663eccf971936ce4a84b54656e38d7b7b4e34bec9cc

SHA512
19ca94fd14789ddc8ca9b56020d219f5fa52e8c4564fa2d3bb5a0cf1a87b0e50bd3e79b15cd44b05a8a64006fc05693e1d373ea656853e35a1e6f0f95bcb15b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
525e8b45693a85514056a2575bcf3c8a

SHA1
c2d7515b4ae24bb2aa6e3f739523b90dedb8ebb2

SHA256
10ee06d523da027564e0fd368af0dc69298e6f7debb07a78a84e811128d24b43

SHA512
edf012e61139dc80afe6d76f8a6d04cac88799c74fcba8abcd9d4528c3d1c3d46e7fdc6f864c6480f6de32b33cbbec7a7d60bf4722e970a40998941761698c5f

Download Submit
memory/4600-0-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/4600-14-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/4648-12-0x0000000000010000-0x0000000000040000-memory.dmp

Filesize
192KB

Download
memory/4648-17-0x0000000000010000-0x0000000000040000-memory.dmp

Filesize
192KB

Download
memory/4648-19-0x0000000000010000-0x0000000000040000-memory.dmp

Filesize
192KB

Download
memory/4648-25-0x0000000000010000-0x0000000000040000-memory.dmp

Filesize
192KB

Download