urelas | 987ef5e69172858ae8dbb7f0b1e9ef9b5f17ab6b0ea3a06358457c606c347535

Analysis

max time kernel
178s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd3310e0e221e01013842cd88c6573c1.exe
Size 447KB
Sample240310-atf7yaff71
SHA256 987ef5e69172858ae8dbb7f0b1e9ef9b5f17ab6b0ea3a06358457c606c347535
MD5 bd3310e0e221e01013842cd88c6573c1
SHA1 5257561dff3bdf0cdd41ee7f9033c88223747042
SHA512 fd5843403e8b4da354b24f1da6b7511e719b3c26216eb6cca65df1f5f830fd0a4ab84da98291427b12122ce4d20e9756f298024d1415a1c925381d1a674e9d4e
SSDEEP 6144:CEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF2:CMpASIcWYx2U6hAJQn3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	bd3310e0e221e01013842cd88c6573c1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	socuk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	buwopy.exe

Executes dropped EXE 3 IoCs

pid	Process
3772	socuk.exe
1616	buwopy.exe
1932	zydal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe
1932	zydal.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3772	3324	bd3310e0e221e01013842cd88c6573c1.exe	93
PID 3324 wrote to memory of 3772	3324	bd3310e0e221e01013842cd88c6573c1.exe	93
PID 3324 wrote to memory of 3772	3324	bd3310e0e221e01013842cd88c6573c1.exe	93
PID 3324 wrote to memory of 1808	3324	bd3310e0e221e01013842cd88c6573c1.exe	94
PID 3324 wrote to memory of 1808	3324	bd3310e0e221e01013842cd88c6573c1.exe	94
PID 3324 wrote to memory of 1808	3324	bd3310e0e221e01013842cd88c6573c1.exe	94
PID 3772 wrote to memory of 1616	3772	socuk.exe	96
PID 3772 wrote to memory of 1616	3772	socuk.exe	96
PID 3772 wrote to memory of 1616	3772	socuk.exe	96
PID 1616 wrote to memory of 1932	1616	buwopy.exe	113
PID 1616 wrote to memory of 1932	1616	buwopy.exe	113
PID 1616 wrote to memory of 1932	1616	buwopy.exe	113
PID 1616 wrote to memory of 632	1616	buwopy.exe	114
PID 1616 wrote to memory of 632	1616	buwopy.exe	114
PID 1616 wrote to memory of 632	1616	buwopy.exe	114

C:\Users\Admin\AppData\Local\Temp\bd3310e0e221e01013842cd88c6573c1.exe
"C:\Users\Admin\AppData\Local\Temp\bd3310e0e221e01013842cd88c6573c1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\socuk.exe
  "C:\Users\Admin\AppData\Local\Temp\socuk.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\buwopy.exe
    "C:\Users\Admin\AppData\Local\Temp\buwopy.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\zydal.exe
      "C:\Users\Admin\AppData\Local\Temp\zydal.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 276B
SHA256 587334ccca93516a3803a763c46677f7d4bcadc0d88caee0e888ac53961ba5e5
MD5 2ce9ccaad2e3b9f2cbf7a27f2bbae0a9
SHA1 9de97295e465547fc724b83ec6099a0f483bfb1b
SHA512 127d786cefb868df49a95b4fd32b6f20e3ac85289694248f4e046c63ca21f380a06a79a10f3079d98ba11f207b78b06144f3d880034590209cb1af6806584c79
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 a49f4a21ed6065af43dc8ef4704736e26122107ff16e26ef682670a5babb431c
MD5 cd3966be10d765a2dfd4e990626299de
SHA1 11ef358dccc0da0a17b200048317bb4bcc40f923
SHA512 1a9abf5bfafeaaab7f1aad14dc78aa07b7b3aebac2d1295574460554483705e7a52fa650647dad5ebb761fea1ef4088b14ab71f87ade8e861d32ce99c727f64a
MD5 SHA1 SHA512

Submit Download

buwopy.exe

Path C:\Users\Admin\AppData\Local\Temp\buwopy.exe
Size 447KB
SHA256 af0c0f48a6b4f16135296cd63390a0278f1781fc7e9a65644430340444c1bb5f
MD5 5fff4eb9a12b4fe423b82da4b727a95b
SHA1 347f795b2f3dbdacf2b3e2c06fec95bad87d9630
SHA512 d326c9fd4c78d35bbcd3077ae5cdbb8738c6de0dc685eb10cb92102f29a231c4f1fe235090ca6998fe17e3ff99643e1bf3a618e8d30e5b587b91d59b4de47140
SSDEEP 6144:CEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFD:CMpASIcWYx2U6hAJQnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 0f2065a5741e108e94de25edef5fb891a95cd2b84e035d5dde1e951363420183
MD5 4fb148d4197fe8e5af1c9dbfd9974e18
SHA1 93fa7bdc8c7b43c7119963033936bc3cea790af1
SHA512 a8e78ac2461792145b7a1de93bab29aa3ffc9f8d7c3fc8f1e759b102433dea48f9a584f13f9971cf1d9fbcd5a894641c7cb654cfac645f5721befbee1ac08811
MD5 SHA1 SHA512

Submit Download

socuk.exe

Path C:\Users\Admin\AppData\Local\Temp\socuk.exe
Size 447KB
SHA256 b19af2169b9c297a8fb05a4828d026fb0df98bab3b74131aeac0c0dce41650d9
MD5 f3b81013d44d5af0c12ad5fc590b698d
SHA1 30bf3493a6814ac4c5ff12addb37a8129c3eca04
SHA512 2ab91fc9d5ece641b74b4f473224c2cb183fa517383b16d6c98708f9000164aa05afd53853f2b27e3cf62e680fdba13ae31c3eba0bf64bf34abea6e9fc98f0b5
SSDEEP 6144:CEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFM:CMpASIcWYx2U6hAJQnJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zydal.exe

Path C:\Users\Admin\AppData\Local\Temp\zydal.exe
Size 223KB
SHA256 3e9494a62dfeb0349c4f40ebcce849db09feda12b2b720272209ce3c1eca679b
MD5 8f928a3cc28ac9274c20a31a26d50e96
SHA1 b19284047720d8bf96aef7c2d4c7707afcffde5b
SHA512 1f0af09811fcee4b4eade8b0ac5383abb96656ee4040acd9cfb1d94a4ec11384db44c9b2b7609d6a9c05e543d2c2a557948c20a3dc94024d059c0ab441e33a01
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3E:unFhSIkAyDgjtS/FZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1616-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1932-36-0x00000000005A0000-0x0000000000640000-memory.dmp

Download

memory/1932-39-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/1932-42-0x00000000005A0000-0x0000000000640000-memory.dmp

Download

memory/1932-43-0x00000000005A0000-0x0000000000640000-memory.dmp

Download

memory/1932-44-0x00000000005A0000-0x0000000000640000-memory.dmp

Download

memory/3324-16-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3324-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3772-25-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3772-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download