urelas | 1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe
Size 452KB
Sample240315-wmax8sfb5t
SHA256 1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8
MD5 9be64a94a23c912170516aa091a8d1ba
SHA1 e8f7bec18ac299955aeb45eb70e0f9ba94ff3721
SHA512 7ab158255627dbc2a299660c3dbc52102719e264424a589109f1e93498c5fdfa76d1df6f5f5478385da4e0a69f4ea6d0b1fc6848910ed7d344973432bfce1bc6
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpo0:PMpASIcWYx2U6hAJQnw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	ozvymi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	vamyx.exe

Executes dropped EXE 3 IoCs

pid	Process
948	vamyx.exe
4216	ozvymi.exe
4856	tiebk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe
4856	tiebk.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 948	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	88
PID 4296 wrote to memory of 948	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	88
PID 4296 wrote to memory of 948	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	88
PID 4296 wrote to memory of 1764	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	89
PID 4296 wrote to memory of 1764	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	89
PID 4296 wrote to memory of 1764	4296	1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe	89
PID 948 wrote to memory of 4216	948	vamyx.exe	91
PID 948 wrote to memory of 4216	948	vamyx.exe	91
PID 948 wrote to memory of 4216	948	vamyx.exe	91
PID 4216 wrote to memory of 4856	4216	ozvymi.exe	108
PID 4216 wrote to memory of 4856	4216	ozvymi.exe	108
PID 4216 wrote to memory of 4856	4216	ozvymi.exe	108
PID 4216 wrote to memory of 1404	4216	ozvymi.exe	109
PID 4216 wrote to memory of 1404	4216	ozvymi.exe	109
PID 4216 wrote to memory of 1404	4216	ozvymi.exe	109

C:\Users\Admin\AppData\Local\Temp\1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe
"C:\Users\Admin\AppData\Local\Temp\1b703f1ae717f85d8d1559dc3f9ff83512ab75bb137fbdd5192f6b0f658f64c8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\vamyx.exe
  "C:\Users\Admin\AppData\Local\Temp\vamyx.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Users\Admin\AppData\Local\Temp\ozvymi.exe
    "C:\Users\Admin\AppData\Local\Temp\ozvymi.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\tiebk.exe
      "C:\Users\Admin\AppData\Local\Temp\tiebk.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 c82db8b5bfe73ec5d7fbf67e17fd891d4fa8c1e0e1579d75fa31af7448457b01
MD5 ac051f39771ac61609c32830783c4d60
SHA1 91f428a509bdded39efb2ae52463280747d0758b
SHA512 20b7aa8bfef48c855f035196f753903399480bc174b22706a2b110b1917113e4f5bf72fb9bc977d98a2f096f66210d9e3575db9fe4849356b4997ce29c1c43e2
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 38bfcd23ded62da8c9309d078d6b30bb3de02d16e4a4f33a74dcfa5bdb9cca8a
MD5 0ea577bcb99d78ef7cf2bccd543d5487
SHA1 728db77241d3dcc6dbdad8a38f7b3b7c075d8037
SHA512 43427eca9a68ff2ae5d1be1dd3accc987e5bddda57320a9424347814f3b2317df01b1901215208f0f7077342993bef41480b663874f95e41ce53aa82fe996faf
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 692e551b6d28bbb28a2c03b8a2de842223889c3b01b49a982ca318761978d652
MD5 67eb5d01b80143eac0167db48df5b8a3
SHA1 60490ae29a07b954aa0c4de99141e6d3f6ae2c77
SHA512 46553603eaef68e09ba941fa64c6b1f5106a9335e96a839c48d9080b475e7d0a8d9cc55076821c7b99cf6f7feaa5576cf97bc2d87aaf71a5c127cb8fab4d0c4b
MD5 SHA1 SHA512

Submit Download

ozvymi.exe

Path C:\Users\Admin\AppData\Local\Temp\ozvymi.exe
Size 452KB
SHA256 cdcd39e5b6df245ff88df5565626828c71c81f21740fce66298ac47e8f15f14b
MD5 5120ebae28f48f5f7c9f82f09b93f734
SHA1 623f02b48437707aa172b2bf8d5757711550f8fe
SHA512 55a11efc854816f0995b60657275be9c970728cece70a35a4ff44a859e09f835883a93012215058462795fa0f8439f31dcd87317138fc18abed21c01ae35db8e
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoe:PMpASIcWYx2U6hAJQn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tiebk.exe

Path C:\Users\Admin\AppData\Local\Temp\tiebk.exe
Size 223KB
SHA256 761ef7b6707b2a6b289986047fdf7c0ed92457a1aa5cd4c5b2dc0d3400097285
MD5 4c0887c027bc19875ebe8bc9dbc22b0b
SHA1 432e8c599100f79168b1c20929349c3151774225
SHA512 60556c4e53337ce6d3d04fec6e289a81899435233ebf48033ffa66eacd3200314240b0d66f88a15d159c14fbb3bc2c389ea0f15463de48e3add8189c5982374f
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3z:unFhSIkAyDgjtS/FZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

vamyx.exe

Path C:\Users\Admin\AppData\Local\Temp\vamyx.exe
Size 452KB
SHA256 9936728c76f37b43c762828d59b1c8c7dd0adaa49e4380a970e926efa8b909d1
MD5 f1a0024d5eb5aba8eb451b1a004e8ada
SHA1 db74c35f143642756b061700ddeb5921fb6bb630
SHA512 fe126fdce8c6a1de54ad2d43460ae92e396bb484e95645ca3b486add3deb9db2389d9fefbac662433b4952f92a69bfc35662ed7eb6371a5516a29fffa203a509
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpo+:PMpASIcWYx2U6hAJQnK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-23-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4216-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4296-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4296-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4856-37-0x0000000000A80000-0x0000000000A81000-memory.dmp

Download

memory/4856-36-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/4856-41-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/4856-42-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/4856-43-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/4856-44-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/4856-45-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download