urelas | 83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
Size

80KB
MD5

ad338ae350b4f9dc221a21060546a030
SHA1

d878e1f2e8f2455584963dd4caad8a33a183bd6b
SHA256

83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72d
SHA512

9cf123fd78efe4acfc8ee18602a5b88c26c61fc29712be56b83266d05e8dc7eb33cf40e02a2a9dba19973a0266294fe9e976b457a000833cdbbdd5aaaf100e91
SSDEEP

1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te7s:4lnhYPlVMqmyAFIRRes

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe

Executes dropped EXE 1 IoCs

pid	Process
3896	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3896	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	83
PID 2112 wrote to memory of 3896	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	83
PID 2112 wrote to memory of 3896	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	83
PID 2112 wrote to memory of 3520	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	84
PID 2112 wrote to memory of 3520	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	84
PID 2112 wrote to memory of 3520	2112	83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe	84

C:\Users\Admin\AppData\Local\Temp\83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe
"C:\Users\Admin\AppData\Local\Temp\83ae6d49a7ade92611bde00b843111ca61fdbad3ee1b1ea0f9e61ebf293cc72dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
dd1155cbc9956e5dbeee97b18e3c4c5a

SHA1
e5f61bc0d1bc9ad93206ea16ddefca0900ea780c

SHA256
53be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7

SHA512
1e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
80KB

MD5
201186d9c5522e4e247ca36198492646

SHA1
48194e6ddf8f5ebf86b0e755bac98352b91ee5bd

SHA256
f206aac31b7036e12b00a6ae21f42884fa50175fb7ea415cfdc77858bed1f3f8

SHA512
d42173d50d7380eafee63fcb8c54ebbe6a90fd940d30650186ee1c9fd2f0901509c38f8ba88fc5704dd7d12e4a218dff7b650810d8e0ae634e4da0b245afe86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
4dccac161b9317e9d8b5b14019477892

SHA1
f3fbdc7fcd9b70fc19b7564152c0d8f5515a7b7f

SHA256
90ebfb2f9cf612071a0fe9a320983d87c74605084035d22c4f5636639dd1a160

SHA512
32f643f899041aa3b304674ddf4d00306b65515431c86b89d53ad2150744f0afe59764ed5ce0c18b57e38a8908ba97d31488f6a8423da90afeaef81491a120bc

Download Submit
memory/2112-0-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/2112-15-0x0000000000050000-0x0000000000080000-memory.dmp

Filesize
192KB

Download
memory/3896-10-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3896-18-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3896-20-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3896-26-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download