urelas | bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163

General

Target

bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe
Size

93KB
MD5

f1e3fef1509efcd20a3e999b10a48330
SHA1

bb28d405a9caa181c1defa210f71cb7f4989670e
SHA256

bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163
SHA512

f739a0a08446ecbe0e7d692214d92523c4e60919020288c333296f1edefc28362a3704eb9fcdbc42ab8600be3ee726e27948bddacc8f7ff4a1cb5d87b669f3f8
SSDEEP

768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwz:heZqP25TuIfmS7Fv1aUZSD9yiIHaz

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2688	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	30
PID 2488 wrote to memory of 2688	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	30
PID 2488 wrote to memory of 2688	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	30
PID 2488 wrote to memory of 2688	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	30
PID 2488 wrote to memory of 2792	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	31
PID 2488 wrote to memory of 2792	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	31
PID 2488 wrote to memory of 2792	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	31
PID 2488 wrote to memory of 2792	2488	bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe	31

C:\Users\Admin\AppData\Local\Temp\bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe
"C:\Users\Admin\AppData\Local\Temp\bb86c1c93377a03af9744e4d603c772e97f868ef8b8591e09d5d53d739f06163N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3f372385bf24b44385f4b1251d3aca4d

SHA1
83546de6ba8f20bd08a15896d34f6242ed64352f

SHA256
b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

SHA512
d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
822f5caa689a2f7f80c38626ed097915

SHA1
a348d7e073ffba5ff5d699f2bafb5655b0731e10

SHA256
05ef5eda83f8297c75e232d4dd96acf852b672166b805cbe009528701975e466

SHA512
7a63ea21336bd45f340e7ce5dea4b6adf287ae7a2c4c303ecb6765901e7afef02ccd354596e9fea9bc939763f1ef8b508d6c836f89c586b7ca689144c3a93c0a

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
93KB

MD5
1f29bd3251c0f3f0f898e2aaa100c680

SHA1
243d2c86822075d5e24254e314399ffb176a32ca

SHA256
6a763382027b7f3e8ca4d064286fdf93b322a65ccbefa7f89aa326c48b77604d

SHA512
c49fe5a1f7573d3cff5ef4248ee64e82c2e311abdb25517b77fb11df4c19aa12262ac465b8d6af450700fbd480ed817f8580a453786530690206f3c763793487

Download Submit
memory/2488-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2488-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2488-8-0x0000000002670000-0x00000000026AB000-memory.dmp

Filesize
236KB

Download
memory/2688-21-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing