Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
03/04/2025, 16:49
General
-
Target
2025-04-03_0d79e1b3fcdef8a4c689bca5c5766763_amadey_smoke-loader.exe
-
Size
464KB
-
MD5
0d79e1b3fcdef8a4c689bca5c5766763
-
SHA1
3c9637dbccaba724c68d6e259b2f7d14b2b111b9
-
SHA256
77a725ed3c4a5f8e7d4c307b393961adf63dae6b5c7994d1fa5c8d7853256e09
-
SHA512
9258cc5e5456147b275334e0bfd083a13d4bd0663eda72bbd8cd8b8168d78bd2bf9a3ccb729a2cbd9c8c3fd9cb10b731dd0e58c2c676ba1d39a760bd61c566b8
-
SSDEEP
12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1UG:Y6tQCG0UUPzEkTn4AC1+N
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
Signatures
-
Urelas
Urelas is a trojan targeting card games.
-
Urelas family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-03_0d79e1b3fcdef8a4c689bca5c5766763_amadey_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-03_0d79e1b3fcdef8a4c689bca5c5766763_amadey_smoke-loader.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\colez.exe"C:\Users\Admin\AppData\Local\Temp\colez.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jopya.exe"C:\Users\Admin\AppData\Local\Temp\jopya.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
338B
MD5efa3e40a914ddef423446005925804db
SHA1119867bfbbd50e97092e882b4834a59c99755324
SHA2566831b37ea8e5540d075a3501b7526eaac4448228f875524c36c7b7b9d821b521
SHA5122b1b7d615746989fc013c48b064039d32ae34113d00650edb895fb2180083306870fdb5869fd95be024e499c440164db31aff615ea073edc753ee8fe53d6b60b
-
Filesize
464KB
MD5b9ff84c4c16d611701a88b33f2b60fc1
SHA123b0aa9b374464edf2f04612aa07815073b33181
SHA25615d25fe523613d1aadfe88c6a24566ce0944c9c78307d4b258862018a546dfc7
SHA512eaba8d6d5e42e6ea3265ecd99c866ac0870956e017eacc16483cf2361926debcc0d824f910609f9137119fefd58b22e3ff3dfa1bb11da6a6c04438028b170086
-
Filesize
512B
MD565991c886b495963a3f4de3f2cf1d8b1
SHA1dbf03cb278c915ba35e44b8620777e13bc8208e6
SHA256addedd65a9ba4c0ee5056705e804aff2165f0e07e2613022fbe6feb533fed462
SHA512d753914c768ea4ff0c3da8f4f8870e9e9dd1cbb091f87ddcf9afabceef8232565666edfe70bb77ad48efd77ea6c0949c3b9854a9916b317f064567faa4edb3b7
-
Filesize
198KB
MD5b7e47d0bbd8dbc4d4b498807434ac635
SHA19427c9b1a2df1f1dee46c8b44fd40cd7a7542adb
SHA256c9b699219d4d887411f396b93dcbf1bf2e44af22b50236b29cee3fceca1f1699
SHA5126237af603af6d319c6cbe8220e2c26a89f09c4277fface6836a3c213228da105f6671e2a0ad7412500e9e32a69a4883a705e068dbb48662f9e6471fa6a781f12
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB
-
Filesize
636KB