urelas | 6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe
Size 328KB
Sample240311-2jdslsae42
SHA256 6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978
MD5 29172c338d7bebcd8090d63d893ca7c5
SHA1 91106422906d39dbc6923502ba3f4339d7a95c09
SHA512 64e87cc8cfbfcbc5e79911a1df56599b716953670e8e6856c83ab6031ad535d24a5533892db7c0450fc6a0e936d2bc420329d24e6ffe8238878ed1191dd0fae9
SSDEEP 6144:sY4zSop9m06QbGTCnTRoOIH3FPA7AthtLpH:PkXpd6jqiOIHZAK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	udfyb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	uztuby.exe

Executes dropped EXE 3 IoCs

pid	Process
1352	udfyb.exe
4968	uztuby.exe
1940	ytcyz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe
1940	ytcyz.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1352	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	90
PID 3164 wrote to memory of 1352	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	90
PID 3164 wrote to memory of 1352	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	90
PID 3164 wrote to memory of 4544	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	91
PID 3164 wrote to memory of 4544	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	91
PID 3164 wrote to memory of 4544	3164	6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe	91
PID 1352 wrote to memory of 4968	1352	udfyb.exe	94
PID 1352 wrote to memory of 4968	1352	udfyb.exe	94
PID 1352 wrote to memory of 4968	1352	udfyb.exe	94
PID 4968 wrote to memory of 1940	4968	uztuby.exe	108
PID 4968 wrote to memory of 1940	4968	uztuby.exe	108
PID 4968 wrote to memory of 1940	4968	uztuby.exe	108
PID 4968 wrote to memory of 740	4968	uztuby.exe	109
PID 4968 wrote to memory of 740	4968	uztuby.exe	109
PID 4968 wrote to memory of 740	4968	uztuby.exe	109

C:\Users\Admin\AppData\Local\Temp\6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe
"C:\Users\Admin\AppData\Local\Temp\6bf498cd0ea7b1cef0619ee0f95081af01fffb4a613cf3cc8c7515623d5ad978.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\udfyb.exe
  "C:\Users\Admin\AppData\Local\Temp\udfyb.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\uztuby.exe
    "C:\Users\Admin\AppData\Local\Temp\uztuby.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\ytcyz.exe
      "C:\Users\Admin\AppData\Local\Temp\ytcyz.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 97837f9670e57f0d52388e50244ee427e0a1cc7a10de3c7cf1c50dcdb853f611
MD5 46000de086386a0c701facfe5addf5cc
SHA1 9ca8000c8f406b40d76e80ddfc8624e121e3e78a
SHA512 341e7e1b04016fb548bc1c935041ef7ae391628b634f4b2144c9c765b1446443ea4072b4546a34d9fde97050dbc9a35f1ec4f3008330632289f230c2623ab966
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 d1851dd24016c00c74131e10200b0c01de08976e36db89d1a0f41e12c77831c6
MD5 01032fe93edbb670906c3a1e81cb6754
SHA1 70e3cb04c5ddcd1b5686e850d162f6b0e0466f3a
SHA512 25607d3341662dfa4a84231a543e78d2652b4d48cf0320857b5c58d59e480551e197d70c569f12b1d12e02d46fabe6009849d1bc90d325fe7dd60113bd4e3060
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 aa854176d947a0671fc9464057b257db622ef0a6b20a693db2a4cbd87861eb91
MD5 593d98472c77473f5f6ce2fb4a5a706f
SHA1 0b3a2b0eacfd7497a97f228ee06b606302415e6f
SHA512 a4a8b1f327462aa3b7eec6c6ea719bc4af267d62c8527070ed322c76389811a1b104052d3c57b231c72b9ee27e666f749311a5a1290f619aec3b11d78ec854c8
MD5 SHA1 SHA512

Submit Download

udfyb.exe

Path C:\Users\Admin\AppData\Local\Temp\udfyb.exe
Size 328KB
SHA256 a489667566795c1e0ca3a6614a347565cd0d0d75740f2ba2c5d71558ff8210e5
MD5 14771a2b7887b22e8b86c0a7738f71d6
SHA1 c857ed4399b56f076e67dd7495da3e256719eb44
SHA512 2a094f780fbc5528fd645cb823f498d5696537c360a1f8701a0c00f185007ae8a133494a2b22cdfa695dfc21a5e7585872d1f9a4d0d374a88d1c546ad3e3c64c
SSDEEP 6144:sY4zSop9m06QbGTCnTRoOIH3FPA7AthtLpT:PkXpd6jqiOIHZAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

uztuby.exe

Path C:\Users\Admin\AppData\Local\Temp\uztuby.exe
Size 328KB
SHA256 c37f46f5bbdbcd4e9cda517763ec38f9b00733e9c7573ad37cf191325b0a6a91
MD5 dc13e0945bce3623ff9b2bcd84695d50
SHA1 3857f65d3bfc63a0106dd566feda8ac3041ed195
SHA512 3ee52fca2c8ee39d7a033f955d1b43ca25ac745e1ba0aff9c769e35d70a1b25ea396127615bdb6c8954b7606dbd78e35aff5631a7ea4fd27caab21bdc56751bd
SSDEEP 6144:sY4zSop9m06QbGTCnTRoOIH3FPA7AthtLp8:PkXpd6jqiOIHZAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ytcyz.exe

Path C:\Users\Admin\AppData\Local\Temp\ytcyz.exe
Size 223KB
SHA256 06f3d2a732da525ec37f8c585cfb19c1838aafe8edfceffdc7d22da7cdbc980a
MD5 e4ef021973026b142aa59e2d61251a3f
SHA1 4b2cb32ea4010b8a68c52db93a1891ebcf336b48
SHA512 91af36a4fbeac847a0d5dd1edaeb77ac67b0339b9c5d4b7ecf55c5f4123fda577260796b34cfe4031d29d4510dde752be143276b531c39f9ee8a6acfe31a7f05
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3r:unFhSIkAyDgjtS/FZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1352-29-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1352-18-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1940-50-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/1940-45-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/1940-53-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/1940-52-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/1940-51-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/1940-44-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/1940-49-0x0000000000E70000-0x0000000000F10000-memory.dmp

Download

memory/3164-3-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3164-1-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3164-2-0x0000000000720000-0x0000000000763000-memory.dmp

Download

memory/3164-19-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/3164-0-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/4968-46-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/4968-32-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/4968-31-0x0000000000400000-0x000000000046F000-memory.dmp

Download