urelas | 1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2025 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe
Size

78KB
MD5

9c4eae1162b7851bbc0b2ebfe5dd98be
SHA1

e454a676c8ee716857a030fbce1c206c4af5f157
SHA256

1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac
SHA512

f38332a38ff54f68209a0a1b6bc4d9224d2b1ef8aa58929ee468b5f44e0a231979b06b289e9ab5e27f3b536be640f708d8cee0e61ee582253259de2f277dcfb1
SSDEEP

768:xZU9HZe4JZxPKAgmmE2jmXwTcxlhshya4qCIDWObp2EfoiSCMy6MuHg/wrYaFRdX:xce4ZKAvTwTcshJDzo9LHyUYmdGT/4

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe

Executes dropped EXE 1 IoCs

pid	Process
4924	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4924	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	86
PID 5008 wrote to memory of 4924	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	86
PID 5008 wrote to memory of 4924	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	86
PID 5008 wrote to memory of 2040	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	87
PID 5008 wrote to memory of 2040	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	87
PID 5008 wrote to memory of 2040	5008	1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe	87

C:\Users\Admin\AppData\Local\Temp\1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe
"C:\Users\Admin\AppData\Local\Temp\1541622e3a6daa44def2d6cfc916541c03abd8728ee9a6efca45777878661dac.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
cb8b3268a58e3e3ea046135a31630bbe

SHA1
9b24e0f46375148ebc245cd6641773e876513ca3

SHA256
fea32526c29951c22eccfc3f837610c29e2843334ef0734f9b68495c14859d0b

SHA512
49ffead156c03719527f8459892e29ec2d7f9842042e885775644ae622d6d4a2746e64c903e8979590631c397f65ba9e59861f89fbd9c3cd2e775c7c933cb746

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
78KB

MD5
27db3b8117267abe100b9ff40670f3fe

SHA1
cc1f5d06a8af045ec3f36615f4776f109f740cdd

SHA256
7a9b5b50d45b1511d8a670b4eaab0bc57ff91af481f47276e6835b07bc7af681

SHA512
b7db849b2c9d75fe3c268df4c208428374cbf6327f5ed281afdb50f229ff8bf3bbcfb3202cd7be1bba8107ec7d1261f157d10c573e2addc7d641ae157e721d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
d928fe6c6cebc2e7d4810bbd6cf3b076

SHA1
52f88689efdd3ae00df74b277d9c2e13cfe6a9ec

SHA256
11e9a680c8fe0152249eb911a194156c6c102bb4c5f0abf63de947da27f81f80

SHA512
a09dec2dd460224a84c90f1013300e0100b6590a1d902075c629c22239956414ddfaa4c20870ba546327326fa2b6ee4dc7eb5b787b37ec81087e634bfb704fb9

Download Submit
memory/4924-10-0x00000000005D0000-0x000000000060C000-memory.dmp

Filesize
240KB

Download
memory/4924-18-0x00000000005D0000-0x000000000060C000-memory.dmp

Filesize
240KB

Download
memory/4924-20-0x00000000005D0000-0x000000000060C000-memory.dmp

Filesize
240KB

Download
memory/4924-26-0x00000000005D0000-0x000000000060C000-memory.dmp

Filesize
240KB

Download
memory/5008-0-0x0000000000310000-0x000000000034C000-memory.dmp

Filesize
240KB

Download
memory/5008-15-0x0000000000310000-0x000000000034C000-memory.dmp

Filesize
240KB

Download