urelas | 9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43

General

Target
9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe
Size 276KB
Sample240309-3yk1xaed89
SHA256 9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43
MD5 528d3d0d491aabb4b2bc7094a9ce0204
SHA1 ae97a6f0b88d07547c4ca745783a5c6dbb715caf
SHA512 af629ec512343f6b0d4cb56009eee774a2470c230cd8429596bdafefa1ce731cc77f8dfcab0b93f61c688f8354a629db66a3a1b10802cb256dd583ae6ce241eb
SSDEEP 3072:QTNKrjisCFASSj8GRQPJ0SatLPTP9ea0frg2UsoutuEGk9Td:QZKHKSIl0SatLPTUBDUsoSuEGs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

C2

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4580-0-0x0000000000400000-0x0000000000447000-memory.dmp	UPX
behavioral2/files/0x000700000002326b-6.dat	UPX
behavioral2/memory/4580-13-0x0000000000400000-0x0000000000447000-memory.dmp	UPX
behavioral2/memory/2596-16-0x0000000000400000-0x0000000000447000-memory.dmp	UPX
behavioral2/memory/2596-17-0x0000000000400000-0x0000000000447000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe

Executes dropped EXE 1 IoCs

pid	Process
2596	cajap.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4580-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/files/0x000700000002326b-6.dat	upx
behavioral2/memory/4580-13-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/memory/2596-16-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/memory/2596-17-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2596	WerFault.exe	98

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2596	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	98
PID 4580 wrote to memory of 2596	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	98
PID 4580 wrote to memory of 2596	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	98
PID 4580 wrote to memory of 1448	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	99
PID 4580 wrote to memory of 1448	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	99
PID 4580 wrote to memory of 1448	4580	9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe	99

C:\Users\Admin\AppData\Local\Temp\9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe
"C:\Users\Admin\AppData\Local\Temp\9872a464b21978e4167e87af6cb1968cf348cd87ea4ca6a6e1412d180334cb43.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\cajap.exe
  "C:\Users\Admin\AppData\Local\Temp\cajap.exe"
  2⤵
  - Executes dropped EXE
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 784
    3⤵
    - Program crash
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2596 -ip 2596
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 e501eae8ac46d27f0eae986ee6472e5f06b360c6cd61d7081451b5ff739fbbe0
MD5 9e46fa5b10cf6f1d74082db45ad521e0
SHA1 b97e99960d692ac36285cc3e090ec2b7fb1c778b
SHA512 1b59998820c94df0437d0b5b8078276055b15c8eb9028cd5fb9cc8cd9772d586e0b6cf01420f8b1dbe6d696f38dc8b36500b4646830af707c806b4a42d757d54
MD5 SHA1 SHA512

Submit Download

cajap.exe

Path C:\Users\Admin\AppData\Local\Temp\cajap.exe
Size 276KB
SHA256 e79ff3ca0388aef8d1886b37c26d0264b3d516e09093d9fea288c53caeee8b2f
MD5 13e3ae09cc1f8064b63a56f7c94d0a19
SHA1 7c333a86ff58ea207e2f384f74d9e676543022b7
SHA512 86456215d6004fd460ec74e309035d59edddd63d7674ceef179788209ee8a9599b88f881aaa9401066883f902bc907c7049680e84e74f99a3393adbbf2266880
SSDEEP 3072:QTNKrjisCFASSj8GRQPJ0SatLPTP9ea0frg2UsoutuEGk9TA:QZKHKSIl0SatLPTUBDUsoSuEG5
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 0bd52248a3949c87895fc130952ef06603fea349e642af9ce7778759d49480ed
MD5 ec7e688c20e3299cabcb946e25e8bbad
SHA1 080598face00c8e5751f008c2fbe17c3ae2c7e34
SHA512 4f3fb4f48d75dc610aa868730a6230ade63de896820165f09e7f567906566b64666d6f3323933bdefb1958a09ea1a62905cba99737e0899c807aa563bd9b4396
MD5 SHA1 SHA512

Submit Download

memory/2596-16-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2596-17-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4580-13-0x0000000000400000-0x0000000000447000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads