urelas | e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe
Size 445KB
Sample240310-bybcxshb31
SHA256 e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf
MD5 3f032cb7c4611688a2ed93132db128ea
SHA1 b5635ace9c98d50756b318f9a6c687d5846e2604
SHA512 c6ee2235bc5a64a71642ac5a4fbea72bfa9bcaee57cfc49ce3543f603c86314c7cac00155b6b58318899715bab0527871783682f6dcfb8ed8ae037e93b9fb3e6
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMj:rKf1PyKa2H3hOHOHz9JQ6zBQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	urygf.exe

Executes dropped EXE 2 IoCs

pid	Process
4032	urygf.exe
4708	musyl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe
4708	musyl.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4032	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	85
PID 3100 wrote to memory of 4032	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	85
PID 3100 wrote to memory of 4032	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	85
PID 3100 wrote to memory of 2388	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	86
PID 3100 wrote to memory of 2388	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	86
PID 3100 wrote to memory of 2388	3100	e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe	86
PID 4032 wrote to memory of 4708	4032	urygf.exe	96
PID 4032 wrote to memory of 4708	4032	urygf.exe	96
PID 4032 wrote to memory of 4708	4032	urygf.exe	96

C:\Users\Admin\AppData\Local\Temp\e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe
"C:\Users\Admin\AppData\Local\Temp\e097a0bf0c45671350682256264bef1fe82745fb1a63e701be40298e28be50bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\urygf.exe
  "C:\Users\Admin\AppData\Local\Temp\urygf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\musyl.exe
    "C:\Users\Admin\AppData\Local\Temp\musyl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 764b35be74ac85b488e7d7a29154b0a42750888abb2174e703df2a929232c450
MD5 903ec6a65ddcad7715e7db95c9c15281
SHA1 f9c74551c8e70524593a048f557386bc1b5d92a9
SHA512 39b146dbb03f6109e57a79c8f5a3391ab69d193270f8255f2a7fa91e25bfee32db955f40c0bf2096d014e834e56755bc1157b6fcd7bb733eefbd4cbf3b2954af
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 49c516568a218107eae11b78ec700aa50ca7210d0e15d8e1f5ef66bad70f4488
MD5 b72f2f745087f8a00bfc82ed66805789
SHA1 d7067c3e7cb7564c999011484b27271c0e37856f
SHA512 e6ea1af181d3775840fb54ca328c462b253d6772a15ffd431196dc4ae912ae2cef8c63e083da42b9cd4579c2c3e41c3f85c85ef0ffc2955c435a93b6c6570f07
MD5 SHA1 SHA512

Submit Download

musyl.exe

Path C:\Users\Admin\AppData\Local\Temp\musyl.exe
Size 230KB
SHA256 aa55c054e49c73aa538b9a2aa7a9a501a655f781665eedec25577c5d3ff04e22
MD5 a3a402c77af7f0b57bfae064cf17a45d
SHA1 75443cc5af68c1d0e4c96cb2412b1b3066d2df53
SHA512 b66f3f33634586bb1fa3d14ae3ae38fcbfdbc516a2ed275597218853ebba8ab0e00f95ab42e30a2529d3e150408c09a8536785147651d475e84459df74eaed06
SSDEEP 3072:/MDCkU0Pj25agjZhUwuxCkKg34um3ZW7zcyEB66tRNy9+ikEV9aUMjIh14t/9:UZxL2vaCk77zZEY69iT3aUMU2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

urygf.exe

Path C:\Users\Admin\AppData\Local\Temp\urygf.exe
Size 445KB
SHA256 3480b1ada945c0dc215d77ca5e0db0ad7ee7414a0a7cfa2246dea8636ceb9ec2
MD5 1ca5b1e015dba38e1318d60f2e607803
SHA1 ef794552620af2e1bd6d69f8cc716ea40ddcdb3a
SHA512 869a5690a33dd13676b3e295262418e71422845a035bf94bd3c13d6d254f7a661b9b02fc893e3a594b94dda76269cb8de728e2332379a71bbea59f5afe5d5244
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMo:rKf1PyKa2H3hOHOHz9JQ6zBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3100-14-0x00000000001A0000-0x000000000020E000-memory.dmp

Download

memory/3100-0-0x00000000001A0000-0x000000000020E000-memory.dmp

Download

memory/4032-10-0x0000000000460000-0x00000000004CE000-memory.dmp

Download

memory/4032-26-0x0000000000460000-0x00000000004CE000-memory.dmp

Download

memory/4708-25-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download

memory/4708-27-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/4708-29-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download

memory/4708-30-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download

memory/4708-31-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download

memory/4708-32-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download

memory/4708-33-0x0000000000C60000-0x0000000000CFE000-memory.dmp

Download