urelas | 90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe
Size

76KB
MD5

1aeebb8cf30ce19b42b7af22800c06ae
SHA1

fec32fd65e180e1b3efef558d31857d3ba510797
SHA256

90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01
SHA512

40bc94e025531e565eb74f881d342940d6b121e38241e1c519eb780ef8b82a2276d863ffceb84d96308a804fc595761413db5a74029fbbcd6e0af1bdab0dde73
SSDEEP

1536:+Uk8RgDXz7Kx8zzgmTlvtKrNCpbXmsz4tHITjt:Tk8yn7KdmTINQXzz4ot

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe

Executes dropped EXE 1 IoCs

pid	Process
2036	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2036	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	84
PID 4928 wrote to memory of 2036	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	84
PID 4928 wrote to memory of 2036	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	84
PID 4928 wrote to memory of 2908	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	85
PID 4928 wrote to memory of 2908	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	85
PID 4928 wrote to memory of 2908	4928	90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe	85

C:\Users\Admin\AppData\Local\Temp\90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe
"C:\Users\Admin\AppData\Local\Temp\90e0866295173f8de8bf1cdd3333aaa2fc986718c516f5e0d6155d3624488f01.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
76eaed1cdcaa3e93de67dd5f94abb63e

SHA1
c0e0ff36484832ed8fd69b50fc2d2691811f218b

SHA256
fe485dd700b9b8c95e9de719dc1eb9ecf25b8f554fc23a3baa679ff12aa173b5

SHA512
bcf04a4f6e80db17fbb6d9be2b9c5722cd2118a6dbf4b2fc8a438efd8df1085fbc2a08047d1aaa909095f48294c2bb454ac66d76110deb6b6ec153b8a1a5511b

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
76KB

MD5
bb9053279502f47f2e41e41a312abbb5

SHA1
9ab4cca6ddaabed0a43cdf5811945ff7fe71093a

SHA256
07b19c9e2ab734e6301bbe70828119e8cb81cd20812cba62cc1c662cc95e90b9

SHA512
3db55ce50d070673b81977f31a1487e98df2d3d43ad52a536483c4fe80e893382593aa69ff730852ed4142b6bf35d3219b707633cb53ba5b8b8d89a67faacc6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c6f10af7562f7d32c406d43b9283c7da

SHA1
b43d0581f6a1808941907421a1a9e888c686f0a0

SHA256
3d9a4aa64712373a9460a27a2c151f48b7a09f01b8d258da0d9459962b96e737

SHA512
d17715eca339379a406364e5559004371a4935ccf9b6935d6f062df9b9cb426961047d81c58dd4384ee113cbe29d4d7d1f78a9c69e656c2a1b0903d02258c05a

Download Submit
memory/2036-13-0x0000000000B60000-0x0000000000B8F000-memory.dmp

Filesize
188KB

Download
memory/2036-21-0x0000000000B60000-0x0000000000B8F000-memory.dmp

Filesize
188KB

Download
memory/2036-23-0x0000000000B60000-0x0000000000B8F000-memory.dmp

Filesize
188KB

Download
memory/2036-29-0x0000000000B60000-0x0000000000B8F000-memory.dmp

Filesize
188KB

Download
memory/4928-0-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download
memory/4928-18-0x0000000000530000-0x000000000055F000-memory.dmp

Filesize
188KB

Download