urelas | 05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971d

General

Target

05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe
Size

92KB
MD5

d4432d51d185f01b1080e01fdb23d1d0
SHA1

ced05141c319b560a2394ea78cd391fcaacf1f63
SHA256

05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971d
SHA512

328a18b8451b806065f337055ed0da923cdf00065d24f312620bfa6a0bf60697295b5402edb4701570155506430d8afa24a60c6490c4063e41784e177fb27494
SSDEEP

768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwDj:heZqP25TuIfmS7Fv1aUZSD9yiIHaX

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2088	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	30
PID 2884 wrote to memory of 2088	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	30
PID 2884 wrote to memory of 2088	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	30
PID 2884 wrote to memory of 2088	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	30
PID 2884 wrote to memory of 3064	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	31
PID 2884 wrote to memory of 3064	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	31
PID 2884 wrote to memory of 3064	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	31
PID 2884 wrote to memory of 3064	2884	05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe	31

C:\Users\Admin\AppData\Local\Temp\05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe
"C:\Users\Admin\AppData\Local\Temp\05d75993b757055e5ad8bc8a99776341f7bc2f5a8083446c04035bc8b24f971dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3f372385bf24b44385f4b1251d3aca4d

SHA1
83546de6ba8f20bd08a15896d34f6242ed64352f

SHA256
b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

SHA512
d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
fcdca837460f4926ce306eefc7102abb

SHA1
a74f472e1d7dcea917375be6a0b83ce959dd23ef

SHA256
0c4adabedeb96d80264b0f81dc46caf1b347ea13534a5245462db283fc7d4688

SHA512
fecdab0e30f2322e1499b7e48e5d3426a046753ac64b9b17c5233249107cb244cee676b9aa939ab16a3f69ed745a4956b1cd278d061af2c513414d95e642b91f

Download Submit
\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
92KB

MD5
38d11af7e77854e13b6aeb0cd89038c9

SHA1
780eaa632a230ecba501f68e9fcfe8fce3b1b302

SHA256
e420c900b51b2064ea9afc357a5937f8b1581ef897b625554cf77054ae7bba66

SHA512
c16ae02228b005fd1d0390d7834af782e840eae3ac12427f263200facbb8439cef4d6a304896f1054f39e3eea59f9104dffdb45d94710969a0cf386aefae429e

Download Submit
memory/2088-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2088-21-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2088-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2884-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2884-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing