urelas | 6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4

General

Target

6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe
Size

93KB
MD5

7498021ea59119fbfa40e8079767d50e
SHA1

b00d1734ba52fd095918ac15fb5682b970c44aad
SHA256

6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4
SHA512

3a493842a48dbf6dbf23b4dd0f74f265cc1d8b4a5afcaea8dd69982f9c9b838d95904d41023769d10edb940a0915f6b15d61b2d54c73e7105a8da16daf1637ba
SSDEEP

768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwz:heZqP25TuIfmS7Fv1aUZSD9yiIHaz

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2904	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2664	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	28
PID 2100 wrote to memory of 2664	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	28
PID 2100 wrote to memory of 2664	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	28
PID 2100 wrote to memory of 2664	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	28
PID 2100 wrote to memory of 2904	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	29
PID 2100 wrote to memory of 2904	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	29
PID 2100 wrote to memory of 2904	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	29
PID 2100 wrote to memory of 2904	2100	6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe	29

C:\Users\Admin\AppData\Local\Temp\6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe
"C:\Users\Admin\AppData\Local\Temp\6e82940a817c10d732982017f6e0ace260adafdcdfc345a9ed7b534fce1211a4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3f372385bf24b44385f4b1251d3aca4d

SHA1
83546de6ba8f20bd08a15896d34f6242ed64352f

SHA256
b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

SHA512
d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c79080bb91e37a922eccba6f93fa7ee6

SHA1
c467db10822b65c167109fe10c936a667bcec049

SHA256
11015970602b69a62e35cb0e4fac95c115ae71e75760e10477869e5c4232eb4e

SHA512
e96d051aad842ba03a576e9146ce2c0b8b4529a4d787eae18a8f2e3f290c7415eeba7d24d6d954554505555cc5399056fb7e03a922e10879410a29eb083d1034

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
93KB

MD5
7e5f20099da4d35a9b86e142f440a741

SHA1
accf795c3865df51d09bf961d9ebcb30175457ac

SHA256
d727f215a855760a1955c868693d42bd0ea95e01bbe365c508e5fc9108a7be1e

SHA512
3f6319f166250f484c5f383d33d8ba1d910f524ded2339785cac726d8754389022415926a7a8c6fe01d5513cbbde54539501d1dfd46bfc0b783278f354487e41

Download Submit
memory/2100-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2100-6-0x00000000028A0000-0x00000000028DB000-memory.dmp

Filesize
236KB

Download
memory/2100-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2664-21-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2664-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing