urelas | 83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72d

General

Target

83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
Size

80KB
MD5

ad338ae350b4f9dc221a21060546a030
SHA1

d878e1f2e8f2455584963dd4caad8a33a183bd6b
SHA256

83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72d
SHA512

9cf123fd78efe4acfc8ee18602a5b88c26c61fc29712be56b83266d05e8dc7eb33cf40e02a2a9dba19973a0266294fe9e976b457a000833cdbbdd5aaaf100e91
SSDEEP

1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te7s:4lnhYPlVMqmyAFIRRes

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2444	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2592	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2592	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	30
PID 1304 wrote to memory of 2592	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	30
PID 1304 wrote to memory of 2592	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	30
PID 1304 wrote to memory of 2592	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	30
PID 1304 wrote to memory of 2444	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	31
PID 1304 wrote to memory of 2444	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	31
PID 1304 wrote to memory of 2444	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	31
PID 1304 wrote to memory of 2444	1304	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	31

C:\Users\Admin\AppData\Local\Temp\83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
"C:\Users\Admin\AppData\Local\Temp\83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
dd1155cbc9956e5dbeee97b18e3c4c5a

SHA1
e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

SHA256
53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

SHA512
1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
4dccac161b9317e9d8b5b14019477892

SHA1
f3fbdc7fcd9b70fc19b7564152c0d8f5515a7b7f

SHA256
90ebfb2f9cf612071a0fe9a320983d87c74605084035d22c4f5636639dd1a160

SHA512
32f643f899041aa3b304674ddf4d00306b65515431c86b89d53ad2150744f0afe59764ed5ce0c18b57e38a8908ba97d31488f6a8423da90afeaef81491a120bc

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
80KB

MD5
a684fd065c09d81d91f09181dfd9f73a

SHA1
af64e0d06a2d4d540be2175878d9094537a84ba1

SHA256
ba5c6106170c7429a02310892b90083fb44d6bdefaf11cbd2f76180830f9ffc2

SHA512
fcd9388ec583a92669e7d3743563a9d54aba57c7d51b6944383bd7b5efe52db257be3310f2979b2a0c4ce39577cfb49780ab4dbb611a111ddb39be6231472a80

Download Submit
memory/1304-0-0x0000000001180000-0x00000000011B0000-memory.dmp

Filesize
192KB

Download
memory/1304-16-0x00000000004C0000-0x00000000004F0000-memory.dmp

Filesize
192KB

Download
memory/1304-19-0x0000000001180000-0x00000000011B0000-memory.dmp

Filesize
192KB

Download
memory/2592-17-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download
memory/2592-22-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download
memory/2592-24-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download
memory/2592-31-0x0000000001000000-0x0000000001030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing