urelas | 80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe
Size

52KB
MD5

53f7562f5cfab376dc22d3325487890e
SHA1

fd32674fe35de1f7d033021f7e7e1f2abfe85280
SHA256

80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4
SHA512

91421292eafd139988289971a8f5091626641f10155ff4f318f8bebbad16243cf4d8ad47b4d793fd93a2d60d788518494ea1046854c7e7dff45e73b3f1f6a9d5
SSDEEP

1536:h+Ds6ClDXuqweo/0khAUnJDgabGsVy6umfFlPhPl:KsdXfBo/DBJBGzkP5Pl

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183

218.54.28.139

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe

Executes dropped EXE 1 IoCs

pid	Process
2824	shoste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shoste.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2824	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	85
PID 2484 wrote to memory of 2824	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	85
PID 2484 wrote to memory of 2824	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	85
PID 2484 wrote to memory of 2004	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	86
PID 2484 wrote to memory of 2004	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	86
PID 2484 wrote to memory of 2004	2484	80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe	86

C:\Users\Admin\AppData\Local\Temp\80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe
"C:\Users\Admin\AppData\Local\Temp\80224c75ae756cbfbdf0916edb9921eb0f00724cefcca8d06bdd008001e0cbb4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\shoste.exe
  "C:\Users\Admin\AppData\Local\Temp\shoste.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f51c1462254f3bb8aa00201af0b0a030

SHA1
60d3c892bb5c4f654c318451012f936d81164418

SHA256
695c02a7ab1d4a3bf5060ab1c7c63f651dc1fd945c0c5c3263c23db769f689c5

SHA512
41059643033b10394b1593371e22542e4b7f504a3da36ca2cdbf28521dd24bd70d70f42c99f580227e9799c64b5c23c7b9182ca518245b66eb831868e043e0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
d90f832ec97b4fb618b1f8b09792eea0

SHA1
41369d2fbd6ce178d0a2bead0e5f2b1fc0ba167a

SHA256
b9c42f2dbea35f19f6fea7c56db182b4f68b6d78d2d418f7c80575bb82488918

SHA512
5f028c52ff802e8ba1c0de7d230d3e9f59d17102477dbbcbe3611f6fec501f936c99108b71a7f0dadcc03abab49893d7c3fd8b9652389b62890a3c485ee1754b

Download Submit
C:\Users\Admin\AppData\Local\Temp\shoste.exe

Filesize
52KB

MD5
fd4028d004736b1865e671d2692bedd4

SHA1
0ea39eb41ad31864ba338b27f8d6c3e7fbb67dee

SHA256
fac6bbf436b6ee527934078be0884d29532fabfcceb71d93fcea9e721f65bc09

SHA512
b30efa5626e605add98b57bccd18e2a2a9874a2d75e3b18988dd61fa0735d13449229c1a6b71eb68ae24a8647ad41a79f06e17594223f1fb81a5ec3f2f8e64d2

Download Submit
memory/2484-0-0x00000000003E0000-0x0000000000415000-memory.dmp

Filesize
212KB

Download
memory/2484-14-0x00000000003E0000-0x0000000000415000-memory.dmp

Filesize
212KB

Download
memory/2824-12-0x0000000000840000-0x0000000000875000-memory.dmp

Filesize
212KB

Download
memory/2824-17-0x0000000000840000-0x0000000000875000-memory.dmp

Filesize
212KB

Download
memory/2824-24-0x0000000000840000-0x0000000000875000-memory.dmp

Filesize
212KB

Download