urelas | 8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/01/2025, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
Size

541KB
MD5

e848cc55bb658894a350d1c853a1567b
SHA1

d6e57e2c4ade50f89ee9a5b48268bfab2e9db001
SHA256

8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f
SHA512

32b495ec4b7674a5750e8c63b2fa5bd4af7ccef8c9d556f82c1ea2555b1c78719495e78064615e37fad9358d07c2ec6f031d2b751abb724deff26e2be6d82af9
SSDEEP

12288:T52PxDgZo3ijnieactYDG7MzZSHJcvEj8dmoSxuz:92SLi70T7Mifju

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2828	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2728	tofeg.exe
1148	juded.exe

Loads dropped DLL 2 IoCs

pid	Process
2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
2728	tofeg.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/files/0x0032000000019354-4.dat	upx
behavioral1/memory/2936-16-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/memory/2728-19-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral1/memory/2728-25-0x0000000000400000-0x0000000000487000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tofeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	juded.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe
1148	juded.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2728	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	30
PID 2936 wrote to memory of 2728	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	30
PID 2936 wrote to memory of 2728	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	30
PID 2936 wrote to memory of 2728	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	30
PID 2936 wrote to memory of 2828	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	31
PID 2936 wrote to memory of 2828	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	31
PID 2936 wrote to memory of 2828	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	31
PID 2936 wrote to memory of 2828	2936	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	31
PID 2728 wrote to memory of 1148	2728	tofeg.exe	34
PID 2728 wrote to memory of 1148	2728	tofeg.exe	34
PID 2728 wrote to memory of 1148	2728	tofeg.exe	34
PID 2728 wrote to memory of 1148	2728	tofeg.exe	34

C:\Users\Admin\AppData\Local\Temp\8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
"C:\Users\Admin\AppData\Local\Temp\8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\tofeg.exe
  "C:\Users\Admin\AppData\Local\Temp\tofeg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\juded.exe
    "C:\Users\Admin\AppData\Local\Temp\juded.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
861670fb312741d9ad76a7cd2b118d15

SHA1
c43025026fc13dce81c028889695c5c06754bc40

SHA256
b15a683b135b842ef5af69a208694749e49eb14ef43cccd9528295e0657d2bbf

SHA512
f12f5a07cc26de42d069a433b4795d47ace58bad8d1ee5b7accac74361fb101e12334258326a0409a80b874ed9ffd0a03603762d8e259ebd0306a52fb410fd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
94a60d61a1a5bb08428e6eee4808874c

SHA1
5a97b874dc0792782b67a7c4c24611c34f7be0b2

SHA256
b1ec864fcf60d4e055714cf2987657ff7b8755cbd750836399d15068adc2ef34

SHA512
788d8cdecd789f2179bffd41c6a8aae0d149f6e515d5ca56f4bbea9874ce74f0c40b1f578f94f982883cf3dc84271e90c62c167fbe403b89b2901f45dc201b4c

Download Submit
\Users\Admin\AppData\Local\Temp\juded.exe

Filesize
230KB

MD5
4f6d94004b0b43bee4ff30e1987f18f5

SHA1
488d0740cd90418bfe0158ae45e183317640dd9c

SHA256
d7a0a5eb82ef8c38dd93b743eae814c9540b3815f55773414fc592b1f70f161b

SHA512
100bf2e46fd517a5e42c81dce3473ec1f61469491d13bbcf790a8bbefc728740ab9b59890326ab0d9159abc144cf1bd63e8df4b2fc8e8a29377500e82ffcd48b

Download Submit
\Users\Admin\AppData\Local\Temp\tofeg.exe

Filesize
541KB

MD5
80f7b90639e4ec152bd73c03bb31bd9f

SHA1
3a6e7997932c60945a7b5559e6c08c83eeca1c3d

SHA256
e3fe15300ce4bdaf43e917cee1f1acd7ae932a203450b6149158e4c9b18e88f4

SHA512
b870a91d658281e7cc3d8d6934899aee1d85655422d6904d73cbba9600ad674d5eb71c0c3b1cd30a7bcbb9bff2e1a246348ff6522c1bde1f44d30a91268c5768

Download Submit
memory/1148-29-0x0000000000370000-0x0000000000423000-memory.dmp

Filesize
716KB

Download
memory/1148-30-0x0000000000370000-0x0000000000423000-memory.dmp

Filesize
716KB

Download
memory/1148-31-0x0000000000370000-0x0000000000423000-memory.dmp

Filesize
716KB

Download
memory/1148-32-0x0000000000370000-0x0000000000423000-memory.dmp

Filesize
716KB

Download
memory/1148-33-0x0000000000370000-0x0000000000423000-memory.dmp

Filesize
716KB

Download
memory/2728-19-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2728-26-0x00000000033D0000-0x0000000003483000-memory.dmp

Filesize
716KB

Download
memory/2728-25-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2936-16-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2936-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download