urelas | 8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd

General

Target

8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
Size

92KB
MD5

edb353c93c01a6c2e9f09a3f448a541d
SHA1

f1f676b32e3ac1986609f29a6e0a3027dd7df672
SHA256

8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd
SHA512

5f7c8a285a943e2f0cf347e8828b26135c3b4d03da13f5d7e4d842bd1cf2c0d1561802bb0d1a7faf1bf0a799136ff45cde88d982118d0fac1f692f80aa0d864e
SSDEEP

768:2geZ5QeklJQ35pPRuIkUD1sYAQ/TN71N1adOZSHj9jaSCpOzIi7D8kUUUNUEwD7:heZqP25TuIfmS7Fv1aUZSD9yiIHav

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.28.139

121.88.5.183

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe

Executes dropped EXE 1 IoCs

pid	Process
4408	poldge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poldge.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4408	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	84
PID 4984 wrote to memory of 4408	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	84
PID 4984 wrote to memory of 4408	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	84
PID 4984 wrote to memory of 1132	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	85
PID 4984 wrote to memory of 1132	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	85
PID 4984 wrote to memory of 1132	4984	8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe	85

C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe
"C:\Users\Admin\AppData\Local\Temp\8fcf46d3409abcaffbdcd000d8a88cdedff156d39cccbc3d1c20b086a62a5cfd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\poldge.exe
  "C:\Users\Admin\AppData\Local\Temp\poldge.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1132

Network

DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

73.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.31.126.40.in-addr.arpa

IN PTR

Response
DNS

159.96.196.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

159.96.196.23.in-addr.arpa

IN PTR

Response

159.96.196.23.in-addr.arpa

IN PTR

a23-196-96-159deploystaticakamaitechnologiescom
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

200.163.202.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.163.202.172.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom

121.88.5.183:11150

poldge.exe

260 B
5
121.88.5.184:11170

poldge.exe

260 B
5
218.54.28.240:11150

poldge.exe

260 B
5

8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

73.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

73.31.126.40.in-addr.arpa
8.8.8.8:53

159.96.196.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

159.96.196.23.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

200.163.202.172.in-addr.arpa

dns

74 B
160 B
1
1

DNS Request

200.163.202.172.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3f372385bf24b44385f4b1251d3aca4d

SHA1
83546de6ba8f20bd08a15896d34f6242ed64352f

SHA256
b5edef052667b8380ff98c9ff2029faaaa0b1931818a5ef011ce766193ceda27

SHA512
d2f888908ca52c1a99c3d45e83512e2eafd2cc3ae3b782ef0cc80165c4adaf7e488d1aba2028d83fc39e4b8c96c65f82436a10a94e319b9b8aec1f69cd76e5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\poldge.exe

Filesize
92KB

MD5
5153996c8397c9f4e1ac10d298cc1b55

SHA1
79ad9548ed3e1ba7f914442bdd012c4bbc6b5fe8

SHA256
8705956fcb72b79e07184885f9533d93a0aafaefaa7776efa9135fc2a2677e53

SHA512
a573e230ff1c9f9c8d6e9d60d7c85e2bbf925306dc306e8aa3436066d9d909300c39f7b653babffa55780c28888d228520f605620d3dbfd85419b432e119b6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
7c2751929f4eeb92ade834d248663e03

SHA1
2f1853d76a42aa4ae2c7063d8429ce259954e27f

SHA256
fa0f89e1b21db0c9c4a791e9a85aa831f24df1537e2459ca7110167c267099f8

SHA512
e868c4b51d59c51a8d76b927265ca02d2536addc26fc70ea5e97946a15dd0877820d397363135d0899e5a34b157d115579659f8b8e25d9cc38e080c0709cf50e

Download Submit
memory/4408-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4408-22-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4984-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4984-13-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.