urelas | c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14

General

Target

c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe
Size

94KB
MD5

d57898bb6f5a77ee1896b18c848402a0
SHA1

69ffde7483461188092216b58accb344ab3a9672
SHA256

c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14
SHA512

7cb76361053906ffba9b657d9af15bfeb23c94bd4c6addd939ded8ced18b5ae35af0db73288e51e29ff4ee04744c1828eef6b0a7db8b8d8bf5f7312f52f68e88
SSDEEP

768:tp0ti4HnnhtwYbJy6rioyelmd1TzulQEDDPOwc5n5uNCT/jhhLBxQIwqepJZU9m8:tWzhtJbUgHoADDIx1hLfuJr8

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2820	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2824	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2824	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	30
PID 2568 wrote to memory of 2824	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	30
PID 2568 wrote to memory of 2824	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	30
PID 2568 wrote to memory of 2824	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	30
PID 2568 wrote to memory of 2820	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	31
PID 2568 wrote to memory of 2820	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	31
PID 2568 wrote to memory of 2820	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	31
PID 2568 wrote to memory of 2820	2568	c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe	31

C:\Users\Admin\AppData\Local\Temp\c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe
"C:\Users\Admin\AppData\Local\Temp\c2e5c199ed6d3986c04ae7b4a49d674c96a773ef2afb69004a2508db1e2d2a14N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
16c2bcf1dae729c5cb36a1875efe354c

SHA1
775fbf4b6a2e5bc033b86cfc0893250b5d387a45

SHA256
796a881d71234f7fcd9f5220c6e5674e231610bbf37626d9e5b79dc3268b7bb4

SHA512
d8bd6cb6cb6ccd3c2cc40edde9cd3e8c09d1ae55c21ac1896325c324c08507e68c16d3864923806d29db79c57b958dac68e43bdcf809c0a2c8b5b0a7b8557177

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
79fe7eb74f7d8cc21fd5f760b3e34456

SHA1
b1df02d12128a84da518dc8d394ef1d922705a7b

SHA256
5268934584e90a3d1c7e028f920ffcaefb260781fa7a03b0c97d80dbda049793

SHA512
95bfea245a735e5e8854f17ebd074f113e2d6cc44f5e8066552668278abf73a3ddb31491a53f71dbeebb9ce0bc59c8577b89d012f5be1b2f1811c520628e37fc

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
94KB

MD5
b64e755dbf16609d7c617779076f8b0b

SHA1
288e6c4dbf5ad1e861f9cdb1f8ac5167e15df386

SHA256
47303ef79033eb7d2b4156ddeb6e3759170b02743ae03c221464279719a3e0cc

SHA512
668501e9c992eefdb75bc11c820e34a1d445ce91ecdd8714344c48729f89760b840261c1fb0988e425e258ec461d2ec8abc4ec26fdd1c65e9ccda0dd9c3b5faa

Download Submit
memory/2568-0-0x0000000000020000-0x0000000000050000-memory.dmp

Filesize
192KB

Download
memory/2568-8-0x0000000002300000-0x0000000002330000-memory.dmp

Filesize
192KB

Download
memory/2568-19-0x0000000000020000-0x0000000000050000-memory.dmp

Filesize
192KB

Download
memory/2824-17-0x0000000001220000-0x0000000001250000-memory.dmp

Filesize
192KB

Download
memory/2824-22-0x0000000001220000-0x0000000001250000-memory.dmp

Filesize
192KB

Download
memory/2824-24-0x0000000001220000-0x0000000001250000-memory.dmp

Filesize
192KB

Download
memory/2824-31-0x0000000001220000-0x0000000001250000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing