urelas | f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80

Analysis

max time kernel
150s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe
Size 382KB
Sample240302-dvbkmahd8y
SHA256 f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80
MD5 67d0c2bfafe95919c9701b260f852fcc
SHA1 35e2b8f8a2b3358bbf343ee0b7d816b180920632
SHA512 01dcf9b25ec8f38ef629bfae4e74e98bd4cb84c0c2834fd5f696fe545c8da7e5e94523645deb991f849de1e6b87c5b56231df0092096510544526d64ec379b22
SSDEEP 6144:GKMvNQn2DlydH3L9KyGdZIoH5j9u7Q2N0Idgm3wIypgIkd:MV22DlydH3hydZI45P2WUgm37tT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas aspackv2 trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e000000023108-21.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	mujon.exe

Executes dropped EXE 2 IoCs

pid	Process
4704	mujon.exe
1656	jonek.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe
1656	jonek.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4704	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	90
PID 4420 wrote to memory of 4704	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	90
PID 4420 wrote to memory of 4704	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	90
PID 4420 wrote to memory of 4484	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	91
PID 4420 wrote to memory of 4484	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	91
PID 4420 wrote to memory of 4484	4420	f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe	91
PID 4704 wrote to memory of 1656	4704	mujon.exe	98
PID 4704 wrote to memory of 1656	4704	mujon.exe	98
PID 4704 wrote to memory of 1656	4704	mujon.exe	98

C:\Users\Admin\AppData\Local\Temp\f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe
"C:\Users\Admin\AppData\Local\Temp\f05edb6e4454e6eef6848016184c32ebd7b8e36cd4800dab162d961f5ad20f80.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\mujon.exe
  "C:\Users\Admin\AppData\Local\Temp\mujon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Users\Admin\AppData\Local\Temp\jonek.exe
    "C:\Users\Admin\AppData\Local\Temp\jonek.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 340B
SHA256 045abffa452d8124a69cdd58a1ee406de80b58beb5911ccd04bcaf71d340fab4
MD5 6e8e5a18488b58820ad7826bebfffe53
SHA1 b0c2034d73fc84e4e82b6a131fbeb5c9d634196c
SHA512 abf822acf38acea35c0ba4a163d20f4866886f6d29181f03951a734bcca66c87e2058053c3f28b0f498f26f051203cd986c4411b2c8c4d623bbcadbd36d61262
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 332a4c7f478f0792a25380b7155e6b0e0c9986139e20812bf8c2c290ee388531
MD5 46c27aa625d291d55becc36c49f39224
SHA1 02daf5da582a6171fac5732b15d1ff155599cf62
SHA512 30dc2566c4161bb9a1b9908734e4cae3d47f3ed0673d9a83fffa79ef84da0940a6a2680b762bfab36852d2cac288af5cf970373672a749cbde4532c3fde661cf
MD5 SHA1 SHA512

Submit Download

jonek.exe

Path C:\Users\Admin\AppData\Local\Temp\jonek.exe
Size 209KB
SHA256 12edaae8738ab853486ec1b90a2c7ac36c9d4cd22bd77d3cd8a3fe3573cd417f
MD5 7c2fd9d95092038f4530c071321a6b31
SHA1 fb27fb0128d0355665ce28e09be57f02cd5d04f5
SHA512 caff89fd212f128b6326233a204d0e1a0d0319b79f164a4fb3f6802c585864c9b9028ba8c9c342220065af7497fbe2ccacdaa542ab853ae57e8b403a91c9c374
SSDEEP 6144:T3t0bBIYSdewtIaxt+gpc8dO3dsmtLjUFL6pg:zm99sIaxtnph83dsm5jUF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

mujon.exe

Path C:\Users\Admin\AppData\Local\Temp\mujon.exe
Size 382KB
SHA256 10ad13d98ee6adaf795e7c813b9fca2fd3869c8c3d64db0905429f6292e099f4
MD5 06b0ea9ccc6fbdfd6dd0d0c4291149f2
SHA1 745b24c06b6b8d34a7290181794981a338594321
SHA512 291f581d79a6aafc9641cd308f53693c27a1f73e628957e93d59719b73ff276bae356b4ce7241db1433a27e9e8ae5628e547704cd761f25b2aac6d0c8e4276ff
SSDEEP 6144:GKMvNQn2DlydH3L9KyGdZIoH5j9u7Q2N0Idgm3wIypgIkM:MV22DlydH3hydZI45P2WUgm37ti
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1656-27-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-28-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-29-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-31-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-32-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-33-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-34-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/1656-35-0x0000000000490000-0x0000000000523000-memory.dmp

Download

memory/4420-14-0x00000000005D0000-0x0000000000634000-memory.dmp

Download

memory/4420-0-0x00000000005D0000-0x0000000000634000-memory.dmp

Download

memory/4704-12-0x0000000000E30000-0x0000000000E94000-memory.dmp

Download

memory/4704-24-0x0000000000E30000-0x0000000000E94000-memory.dmp

Download