urelas | ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173

Analysis

max time kernel
93s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe
Size

77KB
MD5

5f7079f7d1929930a355dd4f26f0bcb1
SHA1

e8c4c77c47d3cf184b85ebb8e3f2870d2a932667
SHA256

ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173
SHA512

9df88674e32ac33e325e5ec6d7a578566d2041c9e2fb2a439abf4a43a18dff45f6bf9c04805344f6b0dff24dfda11a6110d95310154a08b2bd06aef336983493
SSDEEP

1536:PL2hIZA4fFfgK6xwHquw63wIl3eCEwWsg1p:PLnFYZx7CeCEwre

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3628	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	83
PID 1980 wrote to memory of 3628	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	83
PID 1980 wrote to memory of 3628	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	83
PID 1980 wrote to memory of 3716	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	84
PID 1980 wrote to memory of 3716	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	84
PID 1980 wrote to memory of 3716	1980	ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe	84

C:\Users\Admin\AppData\Local\Temp\ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe
"C:\Users\Admin\AppData\Local\Temp\ac79def9400e9b3ed7d17647fd2eb46cf25d2008a679a84294432f3365a68173.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a0ae699180b5c88a6d361eb8cd1fd1a0

SHA1
d96c983976fe9d29092ed1524c48e29eb6d7d494

SHA256
9e7063a5ccabb60062f55f4e389d03b671ef086985109e6a5126e16059ea3d3c

SHA512
5c2a0aba8917ff43861c6fb5adfd67193e2522c3bd44ee8ed2793c2d29296363bd094b31c16e68c43c812762ba20741ef428e5c19c3318071b9c6ab7b935bb5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
77KB

MD5
bbac76ded95a69da5ab4d6ba8a0cf096

SHA1
9fd794863846ecf46d075a8cccd5f975a8ed173b

SHA256
fc6c750b4130f821266347de30b175f381f38c0b7c2f11c78aa7ca0120ed727e

SHA512
3b030b444bed9fc05c5a847ac538aa43c3fccd73967c729870b78b4b4efcb03c3f053eef89bb9beae86c2394188d55fa53062248fd5542b49a752a3771012164

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
8a8f113e4640dfcaf2c451f806a4f154

SHA1
b4f3c0765955cf21294ad692c16c0edf9bc59771

SHA256
38fb43157a567e36d82dbd62da2f773c7abbd368d02ef430faa8f390c069eb34

SHA512
cd158d365b71ccf7a9289a03dd48630bc36b51f87635e6afb20ef6dbf6da112857622fd6dd8ff7480d4ef7ab001a6816285c1a6513a92fad7ebe4a88059bcd0d

Download Submit
memory/1980-0-0x0000000000AC0000-0x0000000000AFD000-memory.dmp

Filesize
244KB

Download
memory/1980-14-0x0000000000AC0000-0x0000000000AFD000-memory.dmp

Filesize
244KB

Download
memory/3628-10-0x0000000000A90000-0x0000000000ACD000-memory.dmp

Filesize
244KB

Download
memory/3628-17-0x0000000000A90000-0x0000000000ACD000-memory.dmp

Filesize
244KB

Download
memory/3628-19-0x0000000000A90000-0x0000000000ACD000-memory.dmp

Filesize
244KB

Download
memory/3628-25-0x0000000000A90000-0x0000000000ACD000-memory.dmp

Filesize
244KB

Download