urelas | 7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2025, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe
Size 77KB
Sample250118-e1p6mstkhn
SHA256 7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4
MD5 8f572f08e35a886078f6a3c97eaa9130
SHA1 82bf02be182f81832164b42f387607cdcd20abe0
SHA512 dad129ab3a1e650cee5d3b13ba3189cdc44d880d138b6345710e003aa585e3db51f8ecf88246f36a6ce40c4795d5ff1fccea56332d197daf8d3f3ace81a5803a
SSDEEP 1536:PL2hIZA4fFfgK6xwHquw63wIl3eCEwWsg1X:PLnFYZx7CeCEwrk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe

Executes dropped EXE 1 IoCs

pid	Process
4056	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4056	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	82
PID 4916 wrote to memory of 4056	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	82
PID 4916 wrote to memory of 4056	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	82
PID 4916 wrote to memory of 3168	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	83
PID 4916 wrote to memory of 3168	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	83
PID 4916 wrote to memory of 3168	4916	7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe	83

C:\Users\Admin\AppData\Local\Temp\7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe
"C:\Users\Admin\AppData\Local\Temp\7a392492b4e488a7bc2d0be41a135081d0529877a3ac76d4832fd12cc5b982c4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9e7063a5ccabb60062f55f4e389d03b671ef086985109e6a5126e16059ea3d3c
MD5 a0ae699180b5c88a6d361eb8cd1fd1a0
SHA1 d96c983976fe9d29092ed1524c48e29eb6d7d494
SHA512 5c2a0aba8917ff43861c6fb5adfd67193e2522c3bd44ee8ed2793c2d29296363bd094b31c16e68c43c812762ba20741ef428e5c19c3318071b9c6ab7b935bb5f
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 77KB
SHA256 edc05ed20dca0ef08d6992ce1d2714869c21b9956b3ac91d7d376b00c7b0a382
MD5 6b7b84c15f9977a0f3fe598d6d1250a9
SHA1 504793d7dce318fb4c34dd35e4594f529ad4d86d
SHA512 b29280b1886d1e75e39f002c5c2f5e0b5a3c91701727fd23d79a587b8cdc7cc737cfe37f821e307c5553234f84546739c7ffe81e3c49ee5cd0e849d191847f96
SSDEEP 1536:PL2hIZA4fFfgK6xwHquw63wIl3eCEwWsg18:PLnFYZx7CeCEwrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 2cd3d384be012e2e66817537bb9123087c5b8b4a650a5ef3784359ce4ced9410
MD5 4f5fce472cd8e8dce79260c6e4cca637
SHA1 43b8aa2c5baa5e27e126368756d864b0b2d76462
SHA512 fd1983f0a2e7691e27df8ce549f841ea2e6a7be8ed9123f707d128883ce63eeec94159a52bcd3eef940ca774a17306b4c5e4fbec9cd1b21571af84d590d67ddd
MD5 SHA1 SHA512

Submit Download

memory/4056-12-0x0000000000780000-0x00000000007BD000-memory.dmp

Download

memory/4056-18-0x0000000000780000-0x00000000007BD000-memory.dmp

Download

memory/4056-20-0x0000000000780000-0x00000000007BD000-memory.dmp

Download

memory/4056-27-0x0000000000780000-0x00000000007BD000-memory.dmp

Download

memory/4916-0-0x0000000000430000-0x000000000046D000-memory.dmp

Download

memory/4916-15-0x0000000000430000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads