urelas | 9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe
Size 321KB
Sample240310-aac16sfa8x
SHA256 9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe
MD5 0563624146e79e8fc1dea05d68b9fc01
SHA1 1d22393bbd022ec9f1c967c2b9929f2adc1e64a9
SHA512 b3fd49959d28e6e04fdb1e0cb17e6dcd77cf3d0885edd87217e2fd37ebb240176e3527db2cae951a450e2f969c63a3314b8cb10dd106d357b269e39859315748
SSDEEP 6144:TOAztL6W+JJMPkZ5tJb52Wd83erDPKmjxTz7HbYcPCVYhg+K/:TOMFwMPkDH/QiPLxvzblu2FK/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	movet.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe
2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2364	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	28
PID 2168 wrote to memory of 2364	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	28
PID 2168 wrote to memory of 2364	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	28
PID 2168 wrote to memory of 2364	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	28
PID 2168 wrote to memory of 2804	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	29
PID 2168 wrote to memory of 2804	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	29
PID 2168 wrote to memory of 2804	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	29
PID 2168 wrote to memory of 2804	2168	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	29

C:\Users\Admin\AppData\Local\Temp\9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe
"C:\Users\Admin\AppData\Local\Temp\9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\movet.exe
  "C:\Users\Admin\AppData\Local\Temp\movet.exe"
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 c09fdc17a15a6a18dd38227261b0b991119ebce783a0dd9a7a82c722132d4012
MD5 0e67a4984048952969ca11c069a9a604
SHA1 102aa39fb65643fb4441a8057bb28fc1362211f1
SHA512 655fabbfc195ccd6b9219f32fd6c9c11a17d541ba144f750548f7833d0d909156f5ae5cf61f8688a571093f73c5c85c72411dbb53997762cc36b1f8d71df05e3
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ea87ac59c48c7cf01dc074d2e27315e21b23f80ae7a9a68c781d6de810ed7e8d
MD5 c09f2f681c209cfeb936a936cdb6616d
SHA1 12df0fad250498ec5b14b3067efb493d569f58c6
SHA512 be80dbc1bab193eb804d30b3f92004434e0ee0c741e16a3efa3d18c9a381dd559c5f754d74822f6f1d72edf7ae03e90b9757c0b7bc4746fd8faa85fd9e50211f
MD5 SHA1 SHA512

Submit Download

movet.exe

Path \Users\Admin\AppData\Local\Temp\movet.exe
Size 321KB
SHA256 78aec0dd470b975f647554148ab31b85b3def565380d04d899278ce7bfd697a4
MD5 18bf4a8e33277416b96af6e723187e5f
SHA1 077e3455d98247a77232fdaf6b01daa8068bb784
SHA512 a33581f774be39ffd5bce7d348f0ac4c072999dc5c2bafdc20dd69ca8b064d8faa57928a0d07bd66c6b6a458946d8b69e51bf29a8fa7c650665517dd6e78c019
SSDEEP 6144:TOAztL6W+JJMPkZ5tJb52Wd83erDPKmjxTz7HbYcPCVYhg+KK:TOMFwMPkDH/QiPLxvzblu2FKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2168-0-0x00000000002B0000-0x000000000035D000-memory.dmp

Download

memory/2168-19-0x00000000002B0000-0x000000000035D000-memory.dmp

Download

memory/2168-11-0x00000000007B0000-0x000000000085D000-memory.dmp

Download

memory/2364-21-0x0000000000FC0000-0x000000000106D000-memory.dmp

Download

memory/2364-24-0x0000000000FC0000-0x000000000106D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads