urelas | ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe
Size 433KB
Sample240302-ds834shd8t
SHA256 ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c
MD5 1cb281d7ea6b3611ffe2e759a3b82ada
SHA1 59e26a5bf7657290bf423fb8709d60a8116df71f
SHA512 141c4f99a97a3221b0f7b22a59877a9db7a0f03fb67e704cd9476022f5df0386e67c329411443c5a2422d1b4b3b446430d553a61f58035c119c4df6c3bf8ba4e
SSDEEP 6144:DKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fk5T:OANxU3VH1t19MsAlpXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas aspackv2 trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a0000000231b9-20.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	qytea.exe

Executes dropped EXE 2 IoCs

pid	Process
4444	qytea.exe
1836	guhuy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe
1836	guhuy.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4444	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	95
PID 3352 wrote to memory of 4444	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	95
PID 3352 wrote to memory of 4444	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	95
PID 3352 wrote to memory of 924	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	96
PID 3352 wrote to memory of 924	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	96
PID 3352 wrote to memory of 924	3352	ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe	96
PID 4444 wrote to memory of 1836	4444	qytea.exe	105
PID 4444 wrote to memory of 1836	4444	qytea.exe	105
PID 4444 wrote to memory of 1836	4444	qytea.exe	105

C:\Users\Admin\AppData\Local\Temp\ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe
"C:\Users\Admin\AppData\Local\Temp\ef750d0277dd6f49dad4fbce12e6dd66812e41d679c4262fc2c93428c768228c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\qytea.exe
  "C:\Users\Admin\AppData\Local\Temp\qytea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\guhuy.exe
    "C:\Users\Admin\AppData\Local\Temp\guhuy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 00938103648339f23387796c1d3e020b7e7cd309e916212404defe9b6a5a43d4
MD5 f2e9e95c8c36ba8ea6e9df3046630810
SHA1 a7e27799b96f86cd7f0e41c2e75889df87cf67ac
SHA512 59609e9502a6e7ab0ed1314632db4a6c76279ba79998d73fcdc35e8a91bf4a5975f0ecf3fbef6c29462c14d373b9085d0beaa5648bd0a3423d4fbc662bef0522
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 eab778866f8db16b0d318dbd08f7100fc8ae6a63034f2821b665f4e04756192e
MD5 f2f30925ce8ec2205341dce3fa20a7db
SHA1 6903f03d7da4ef04d5bbb49f79f717dc3f2f8c42
SHA512 34bc1d0cd4a1b797695768441bec390a50667441437248d9eadc2f59d09552881e5bb9a9184d23d5619edfb0bb95df601227bedb33201caa10faba819829eef4
MD5 SHA1 SHA512

Submit Download

guhuy.exe

Path C:\Users\Admin\AppData\Local\Temp\guhuy.exe
Size 216KB
SHA256 03e81a81b4d1bdb19c806f92de5dc55cd3059b1f51d1476201ca8b4c44318f51
MD5 954f534ce0d24d116db03b31ad2f9508
SHA1 c1b5515aa03396daeb700347d2613f6aa32815d6
SHA512 1485de22ee109da73979198a441755dc107e7630de972f779c4f702df74ddffe256a7e6049d0eaa1247de6a4902aadf8d1f5dd80c1fac625925fe46d52437a3e
SSDEEP 3072:YyDmf1IUr5Jw/zD1Ms6N7/ZaToVRWw/38EzOO9yCw+4/cFZu:1Dm91SrZMs6R/9ZkhOyWTZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

qytea.exe

Path C:\Users\Admin\AppData\Local\Temp\qytea.exe
Size 433KB
SHA256 2e12f2a6a4b98a000cf49c055d19f12688140433ef1f8dc285dac7a16db03f46
MD5 53890cf34b23ec354469d8f49c0900fc
SHA1 9598ecf029f695a0dc3b8a448eb4e6aef3cb240d
SHA512 7406cf1250a20a990ba27c2afd91f9f288a792efffc1ff305fd97754bda9699c1db2c1d1e7deca827087ed39cd18ae5237c092593f8b88ecba4bb42c75e54b69
SSDEEP 6144:DKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fk5u:OANxU3VH1t19MsAlpXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-25-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-28-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-26-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-30-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-31-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-32-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/1836-33-0x0000000000E60000-0x0000000000F02000-memory.dmp

Download

memory/3352-13-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/4444-27-0x0000000000400000-0x000000000046A000-memory.dmp

Download