urelas | 255545ed1bd0d5209873370cc88901ad114fe8ce04fc3250bfb145153c562ac4

Analysis

max time kernel
248s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa387482fde8b6558331be3e65e21d30_exe32.exe
Size

340KB
MD5

aa387482fde8b6558331be3e65e21d30
SHA1

3ea1348a718b0486f56e70a961e87ed9fddf2ec6
SHA256

255545ed1bd0d5209873370cc88901ad114fe8ce04fc3250bfb145153c562ac4
SHA512

ed00ef26f5d786ee76c479ae757c8eb6781af9e1586d2c68e52dedc4acfb69409f9d8b39d6dc3ea38f06d1383ea0f43ff35aa67681f1d43f116d5e77217b9ca7
SSDEEP

6144:DX+psoWJ+IvLI7BziS3qoJGd2GexPZmxMcVp0Xps:ymoWkI094og2GgPZkiu

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	aa387482fde8b6558331be3e65e21d30_exe32.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	lakii.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4900	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	84
PID 1388 wrote to memory of 4900	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	84
PID 1388 wrote to memory of 4900	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	84
PID 1388 wrote to memory of 4796	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	85
PID 1388 wrote to memory of 4796	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	85
PID 1388 wrote to memory of 4796	1388	aa387482fde8b6558331be3e65e21d30_exe32.exe	85

C:\Users\Admin\AppData\Local\Temp\aa387482fde8b6558331be3e65e21d30_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\aa387482fde8b6558331be3e65e21d30_exe32.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\lakii.exe
  "C:\Users\Admin\AppData\Local\Temp\lakii.exe"
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
288B

MD5
444d2d50e005c2993eae56608f486a27

SHA1
39275fc9963ea604495179fa88cdcd0ae853979a

SHA256
8ad22721e12c8330dfa8e1e6455ed8da11b13f2517fe285d1f2f8837672ca989

SHA512
caeace56f25e5ddae5f3239bdc6b7a0dd958ffe803b7f800a03ca711b9e835e03442b1a81a886ee99db4f1e854b19548bbf105146c3925cb7419f8a606369402

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
56794c51d24bab21434ccfe2091ed7cf

SHA1
38fcf3a0130c4f76f697b217371f4e6b3673655e

SHA256
d45d4f76fe72e814c8a9522daa65a60181eebeae42ec3c9fd3fddcd5b6d12ddb

SHA512
28c3e92831af60e51450a6c7b7cfdf9cace8829bfe17791933c0ec70ceb000d66fb735dd2119aeae5ae61fc98c4e901a7fc1c665996b40da0d86c573bb06cc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\lakii.exe

Filesize
340KB

MD5
7b8d04c3785e1710fba34b3aba6a0abc

SHA1
206d356f5ec987a5b5bc8b9e92a6401277d5a5f4

SHA256
a5c328e4aaff114ca2677dd3690584a4eca2d7be669fe36c8fbf596cb6daba0d

SHA512
5fd61a1adc208234c7578bd65770fb1102296f36ffcde52613a550877a509dd37ce366c3cfe8a2ff2d7008aa25219b2e79a225a41028992eee95cd17d05e6db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lakii.exe

Filesize
340KB

MD5
7b8d04c3785e1710fba34b3aba6a0abc

SHA1
206d356f5ec987a5b5bc8b9e92a6401277d5a5f4

SHA256
a5c328e4aaff114ca2677dd3690584a4eca2d7be669fe36c8fbf596cb6daba0d

SHA512
5fd61a1adc208234c7578bd65770fb1102296f36ffcde52613a550877a509dd37ce366c3cfe8a2ff2d7008aa25219b2e79a225a41028992eee95cd17d05e6db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lakii.exe

Filesize
340KB

MD5
7b8d04c3785e1710fba34b3aba6a0abc

SHA1
206d356f5ec987a5b5bc8b9e92a6401277d5a5f4

SHA256
a5c328e4aaff114ca2677dd3690584a4eca2d7be669fe36c8fbf596cb6daba0d

SHA512
5fd61a1adc208234c7578bd65770fb1102296f36ffcde52613a550877a509dd37ce366c3cfe8a2ff2d7008aa25219b2e79a225a41028992eee95cd17d05e6db6

Download Submit
memory/1388-0-0x0000000000DD0000-0x0000000000E9C000-memory.dmp

Filesize
816KB

Download
memory/1388-3-0x0000000000DD0000-0x0000000000E9C000-memory.dmp

Filesize
816KB

Download
memory/1388-4-0x0000000000DD0000-0x0000000000E9C000-memory.dmp

Filesize
816KB

Download
memory/1388-20-0x0000000000DD0000-0x0000000000E9C000-memory.dmp

Filesize
816KB

Download
memory/4900-19-0x0000000000790000-0x000000000085C000-memory.dmp

Filesize
816KB

Download
memory/4900-23-0x0000000000790000-0x000000000085C000-memory.dmp

Filesize
816KB

Download
memory/4900-24-0x0000000000790000-0x000000000085C000-memory.dmp

Filesize
816KB

Download