urelas | 8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd

General

Target

8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
Size

92KB
MD5

edb353c93c01a6c2e9f09a3f448a541d
SHA1

f1f676b32e3ac1986609f29a6e0a3027dd7df672
SHA256

8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd
SHA512

5f7c8a285a943e2f0cf347e8828b26135c3b4d03da13f5d7e4d842bd1cf2c0d1561802bb0d1a7faf1bf0a799136ff45cde88d982118d0fac1f692f80aa0d864e
SSDEEP

768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwD7:heZqP25TuIfmS7Fv1aUZSD9yiIHav

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2064	poldge.exe

Loads dropped DLL 1 IoCs

pid	Process
2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2064	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	30
PID 2556 wrote to memory of 2064	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	30
PID 2556 wrote to memory of 2064	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	30
PID 2556 wrote to memory of 2064	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	30
PID 2556 wrote to memory of 2620	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	31
PID 2556 wrote to memory of 2620	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	31
PID 2556 wrote to memory of 2620	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	31
PID 2556 wrote to memory of 2620	2556	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	31

C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
"C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3f372385bf24b44385f4b1251d3aca4d

SHA1
83546de6ba8f20bd08a15896d34f6242ed64352f

SHA256
b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

SHA512
d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
92KB

MD5
ea990c556a87f149db45bf6d98eefc94

SHA1
3b44c4636c12cd5dce545a206913d2006508c95f

SHA256
400351e5fc26eccaa05165760b8e57701c4f3afea25190f7c7cce7178c32daaf

SHA512
03f2b4485292bb671ea5b305c35772c45c082ca76cffc2f54312e702f9ce7f0a63f8fe889208293477bb4a6ed2b36f364fc365a866766c159449a30d50f7b358

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
7c2751929f4eeb92ade834d248663e03

SHA1
2f1853d76a42aa4ae2c7063d8429ce259954e27f

SHA256
fa0f89e1b21db0c9c4a791e9a85aa831f24df1537e2459ca7110167c267099f8

SHA512
e868c4b51d59c51a8d76b927265ca02d2536addc26fc70ea5e97946a15dd0877820d397363135d0899e5a34b157d115579659f8b8e25d9cc38e080c0709cf50e

Download Submit
memory/2064-10-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2064-21-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2064-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2556-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2556-8-0x0000000002470000-0x00000000024AB000-memory.dmp

Filesize
236KB

Download
memory/2556-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing