urelas | 9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe
Size 321KB
Sample240310-aac16sfa8x
SHA256 9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe
MD5 0563624146e79e8fc1dea05d68b9fc01
SHA1 1d22393bbd022ec9f1c967c2b9929f2adc1e64a9
SHA512 b3fd49959d28e6e04fdb1e0cb17e6dcd77cf3d0885edd87217e2fd37ebb240176e3527db2cae951a450e2f969c63a3314b8cb10dd106d357b269e39859315748
SSDEEP 6144:TOAztL6W+JJMPkZ5tJb52Wd83erDPKmjxTz7HbYcPCVYhg+K/:TOMFwMPkDH/QiPLxvzblu2FK/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe

Executes dropped EXE 1 IoCs

pid	Process
3296	diacq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3296	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	94
PID 1104 wrote to memory of 3296	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	94
PID 1104 wrote to memory of 3296	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	94
PID 1104 wrote to memory of 2692	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	95
PID 1104 wrote to memory of 2692	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	95
PID 1104 wrote to memory of 2692	1104	9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe	95

C:\Users\Admin\AppData\Local\Temp\9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe
"C:\Users\Admin\AppData\Local\Temp\9c22ba3280d66403081ec6d52c193214aec1c7bd1e74cc04555be91df6e905fe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\diacq.exe
  "C:\Users\Admin\AppData\Local\Temp\diacq.exe"
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 c09fdc17a15a6a18dd38227261b0b991119ebce783a0dd9a7a82c722132d4012
MD5 0e67a4984048952969ca11c069a9a604
SHA1 102aa39fb65643fb4441a8057bb28fc1362211f1
SHA512 655fabbfc195ccd6b9219f32fd6c9c11a17d541ba144f750548f7833d0d909156f5ae5cf61f8688a571093f73c5c85c72411dbb53997762cc36b1f8d71df05e3
MD5 SHA1 SHA512

Submit Download

diacq.exe

Path C:\Users\Admin\AppData\Local\Temp\diacq.exe
Size 321KB
SHA256 4f4cdf2a9d320d00fd186bf4950ff7354088bad1d2f401de005425fb36c18260
MD5 55123fd688d7eeebeed4093c9366feb6
SHA1 d56c6521d26619e6a2762bab6766e490c36f7770
SHA512 d0133cae418722ad2e56dea627031961abb8eeafb68ceb9be290b1416d79fab291204a7d73549c3c35bbbc0d0e6702a8d16150353a533d50a5b1916c33990ad3
SSDEEP 6144:TOAztL6W+JJMPkZ5tJb52Wd83erDPKmjxTz7HbYcPCVYhg+KW:TOMFwMPkDH/QiPLxvzblu2FKW
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 610b0d96d51023ec4fba2f811a106901bc369a99610441a6fe45161ab5161759
MD5 30d2e33a2480a7b9360a1288bc71d6a2
SHA1 f68bec6024ce89f48ce8db85d62f30f9aa73af43
SHA512 86af9798113a339fd25cf64a17c1d06b2ecc8ffdad6cfe781eda2447e178660890a9c466e5f43ca2984f35cffa08a8cd36629299cb9f3c262a368734e444a665
MD5 SHA1 SHA512

Submit Download

memory/1104-0-0x0000000000550000-0x00000000005FD000-memory.dmp

Download

memory/1104-14-0x0000000000550000-0x00000000005FD000-memory.dmp

Download

memory/3296-10-0x0000000000E00000-0x0000000000EAD000-memory.dmp

Download

memory/3296-17-0x0000000000E00000-0x0000000000EAD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads