urelas | 7637a8e8688690ceb440cc9670e9c4ea5daeb70704ed092af47a7d140d57f271

Analysis

max time kernel
149s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf26196379ccb4db51f8187bf5724769.exe
Size 401KB
Sample240310-vm73asha6s
SHA256 7637a8e8688690ceb440cc9670e9c4ea5daeb70704ed092af47a7d140d57f271
MD5 bf26196379ccb4db51f8187bf5724769
SHA1 3cab086a8200d17b5f3f2170cab25c00b697af9f
SHA512 3a589526c1ffc2eed709a5c85356e7deb95dc5083103e8f43c325ca5516591d4663f253367b1ff61d361219ce30bfc37205c038f2e637bb939968acc943153d2
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohb:8IfBoDWoyFblU6hAJQnO1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bf26196379ccb4db51f8187bf5724769.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	onpoe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	buguco.exe

Executes dropped EXE 3 IoCs

pid	Process
2288	onpoe.exe
4684	buguco.exe
4116	betuh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe
4116	betuh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2288	4040	bf26196379ccb4db51f8187bf5724769.exe	84
PID 4040 wrote to memory of 2288	4040	bf26196379ccb4db51f8187bf5724769.exe	84
PID 4040 wrote to memory of 2288	4040	bf26196379ccb4db51f8187bf5724769.exe	84
PID 4040 wrote to memory of 3748	4040	bf26196379ccb4db51f8187bf5724769.exe	85
PID 4040 wrote to memory of 3748	4040	bf26196379ccb4db51f8187bf5724769.exe	85
PID 4040 wrote to memory of 3748	4040	bf26196379ccb4db51f8187bf5724769.exe	85
PID 2288 wrote to memory of 4684	2288	onpoe.exe	87
PID 2288 wrote to memory of 4684	2288	onpoe.exe	87
PID 2288 wrote to memory of 4684	2288	onpoe.exe	87
PID 4684 wrote to memory of 4116	4684	buguco.exe	96
PID 4684 wrote to memory of 4116	4684	buguco.exe	96
PID 4684 wrote to memory of 4116	4684	buguco.exe	96
PID 4684 wrote to memory of 1980	4684	buguco.exe	97
PID 4684 wrote to memory of 1980	4684	buguco.exe	97
PID 4684 wrote to memory of 1980	4684	buguco.exe	97

C:\Users\Admin\AppData\Local\Temp\bf26196379ccb4db51f8187bf5724769.exe
"C:\Users\Admin\AppData\Local\Temp\bf26196379ccb4db51f8187bf5724769.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\onpoe.exe
  "C:\Users\Admin\AppData\Local\Temp\onpoe.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\buguco.exe
    "C:\Users\Admin\AppData\Local\Temp\buguco.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\betuh.exe
      "C:\Users\Admin\AppData\Local\Temp\betuh.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 be7f633203439be4bcad8e4ebc3047e646cb12f89ce8597779dadaa77fd83e39
MD5 ae4a9081a57d1c97b8ec91d28e3a56dc
SHA1 efb57ac011fac06621bb8775c2fb944f1caf6b70
SHA512 d5a88d75abfe2b95b62561426220c4a03decaa895ce13d37cec9f01c92e20e72809f632937e63c93b494dcd0246d9a25b7d446ae9183038a14b349f4071de183
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 276B
SHA256 3ec6dd4fcc62ea242c3f270fe95ba48b86d33fa85dfbd08243cec4c3112d6d3a
MD5 57d3b140e4a86a194aa1a1b95b1a0912
SHA1 9a0d3f416e3aed0f55ce46d86cc376a948de3e26
SHA512 c65c17e21c0cdca0d243649f4fbc3f1e2e33c1c12f0f8b25fb7f1a827fdfedd9847d103f9c4df4bfc57eff50bc54f7aed0676fb2bfb53ef08abc448134f88378
MD5 SHA1 SHA512

Submit Download

betuh.exe

Path C:\Users\Admin\AppData\Local\Temp\betuh.exe
Size 223KB
SHA256 f4f95d3e6c40a3eac1fcc90fad63bfc51844e9426d1789b18f6822715b6ab8cd
MD5 3ea90c10e400a45be69ec8b2684a6b1f
SHA1 9ce3a292a8fe867e8f0d8b6edc5f21d4a42c1aed
SHA512 179ee6f5605256522dc294f9c224a2f5132662092bb64e43148df09c212eb5eb5032a3e32b6c05c32fa1e15ddf16491a8517c86f0c9e7f2862902ec8777d69dd
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3A:unFhSIkAyDgjtS/FZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

buguco.exe

Path C:\Users\Admin\AppData\Local\Temp\buguco.exe
Size 401KB
SHA256 fea70828d0cf35f4777135afab1925246b3046db889c417c2bf17b49ee0f4ed0
MD5 f3288526f137f5ccc39bf609e2b2035a
SHA1 e935dece09831fa20c6b7f2f923d0effccdacde5
SHA512 48c6fe1d868f1ca073657b557b88b182b0e9f8e227fe5c7b4704a47195a2293985671938802a5ef88205f48521d761c72e5bb5e6d1b922fbb77421b4d2ee2cc1
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohr:8IfBoDWoyFblU6hAJQnOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 070514c18307b54e14a946d28e4e56452a1b922932c398240faa3deee4c15f2f
MD5 570d216ffa6ddf241c8ec58f14a89e9f
SHA1 2af84cc3431aeda8f20123852b033221e2bf8b84
SHA512 c1c3c83b3167e30bc2302031e52fae43e331dfe9013a0ffba2a6b07e89a5055496ce9c608a54d0eb7b64d345eab6a9906f323c625f41d72742dba20d5fe3fc21
MD5 SHA1 SHA512

Submit Download

onpoe.exe

Path C:\Users\Admin\AppData\Local\Temp\onpoe.exe
Size 401KB
SHA256 f0ed739186297721a41f03eec62025b512d5bb49335916cd26cafdf541f10557
MD5 dc05242b2690f86df4e5fd2f5d5bfa10
SHA1 60dcacfa4ade9c97679ba7f9e679fd83f8f5ffeb
SHA512 d42344a29e1cc46cce213bf257ffc64e5fde7e299b1afe115ce1d209763becd5b89d3340211551dbb250b0a1881fc4607b3f399423bca83ebc8862c3041cde0a
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohw:8IfBoDWoyFblU6hAJQnOe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2288-13-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2288-25-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4040-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4040-15-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4116-46-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4116-37-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4116-39-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/4116-47-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4116-43-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4116-44-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4116-45-0x00000000001A0000-0x0000000000240000-memory.dmp

Download

memory/4684-26-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4684-40-0x0000000000400000-0x00000000004679C5-memory.dmp

Download