urelas | c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe
Size 420KB
Sample240302-brw12sge32
SHA256 c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212
MD5 a24d7d0130efe55382c8210712dee69b
SHA1 254414bdb5b5b399e683ebeccd375375ad0d9a6e
SHA512 b55d7cf833e4f745c37abd3d47db14afd428443100daca859bfd99b7f1a12beec4e3e010b063336d748b86a9139f12b29d14fc00ff4703a756d413733b5e812b
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGM:uU7M5ijWh0XOW4sEfeOn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas aspackv2 trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001e76b-20.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	mysul.exe

Executes dropped EXE 2 IoCs

pid	Process
2064	mysul.exe
5080	duahx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2064	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	91
PID 2596 wrote to memory of 2064	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	91
PID 2596 wrote to memory of 2064	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	91
PID 2596 wrote to memory of 4568	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	93
PID 2596 wrote to memory of 4568	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	93
PID 2596 wrote to memory of 4568	2596	c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe	93
PID 2064 wrote to memory of 5080	2064	mysul.exe	99
PID 2064 wrote to memory of 5080	2064	mysul.exe	99
PID 2064 wrote to memory of 5080	2064	mysul.exe	99

C:\Users\Admin\AppData\Local\Temp\c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe
"C:\Users\Admin\AppData\Local\Temp\c068b023e71bbfa1ac38163ead4459c58848a1135ea841af6cc47b691aaff212.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\mysul.exe
  "C:\Users\Admin\AppData\Local\Temp\mysul.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Local\Temp\duahx.exe
    "C:\Users\Admin\AppData\Local\Temp\duahx.exe"
    3⤵
    - Executes dropped EXE
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 b66a9330e991a110be017afbc3404c6655a4bc0e7abe62cddf88ba43c9192fe0
MD5 598dd93fa69492708f5b39acda04fb29
SHA1 7bffa289ae939214521075f9d8549c4ab0a0fa8f
SHA512 f447867ac5565b99751eb47fd5b882da25f347852a6494868b3eaf4a04c2c2207f9fb9fff916006d2a57e2ab7cdd2cd239351bd9cfecbc8d172a478ce0510348
MD5 SHA1 SHA512

Submit Download

duahx.exe

Path C:\Users\Admin\AppData\Local\Temp\duahx.exe
Size 212KB
SHA256 77ef62c7488e5a73175b7ca2de8e8bb57600158b4a7d4cd8085572f5fb2d9a5f
MD5 b0b945959c21b3445f09acd7e8e06be4
SHA1 ff0ff11de98d500b908e0486aefe2ebc309f75b5
SHA512 a88179c4ca4ad80bf9f4c2ef6698ddc287bfc87625bf83443558d9633ef8d64049fea095b73ab92e774d23ef2df5c0579e6f4b24a91eb1d8fc6e5ce744694fba
SSDEEP 3072:AyM5pMZ3TRUMf8cXyGeK5+SQv15VQIN3C9ISE0qJiNlUtpEICW:rM5piVVZPeVQISzqJRp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9e463414bd140f6c8b0fdab335dfbe3d41156246576574d366704947f6ed2ad8
MD5 5d552f4350e9d2106ff228354e610e2b
SHA1 9415624e97ece91f2dd05fa3a3e18d4ae30a9c26
SHA512 aaf13ec51fe5ac193a21d89ed9892a5eef0e0765ca654b0617b5c79672de43aac07988a6129ce9ebf98608f13ecb22e2a4b72df61a53f33214e72f185615d3b6
MD5 SHA1 SHA512

Submit Download

mysul.exe

Path C:\Users\Admin\AppData\Local\Temp\mysul.exe
Size 420KB
SHA256 d84f1ffb15251f6978c9d0373d631d6525c6c904583383ce71e29124da74bf26
MD5 209e1741f169bab1d135f6479234e374
SHA1 7ad9121bad9a5e37c10577b34aee9589bb02a0a0
SHA512 44be6bd604d3bd42b254807c4007ae791697a2d52e79b951c3bcafea3f28c6743cab8e586ba878483d99b49dacfe5f9f6d977e76c16f347b1d004ecb2f2ce0a2
SSDEEP 6144:UzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODGZ:uU7M5ijWh0XOW4sEfeOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2064-23-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2596-13-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2596-0-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/5080-24-0x0000000000790000-0x0000000000824000-memory.dmp

Download

memory/5080-25-0x0000000000790000-0x0000000000824000-memory.dmp

Download

memory/5080-26-0x0000000000790000-0x0000000000824000-memory.dmp

Download

memory/5080-27-0x0000000000790000-0x0000000000824000-memory.dmp

Download

memory/5080-28-0x0000000000790000-0x0000000000824000-memory.dmp

Download

memory/5080-29-0x0000000000790000-0x0000000000824000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads