Malware Analysis Report

2025-08-05 19:40

Sample ID 240316-2sjp8aga99
Target cf45b2e62fb61b7f2757cf2d1beb08a6
SHA256 af464d9f2c1bb1caf81f3cb1dc3d67c7d577fdca066d0c650b995c54e9d74e70
Tags
urelas trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

af464d9f2c1bb1caf81f3cb1dc3d67c7d577fdca066d0c650b995c54e9d74e70

Threat Level: Known bad

The file cf45b2e62fb61b7f2757cf2d1beb08a6 was found to be: Known bad.

Malicious Activity Summary

urelas trojan upx

Urelas family

Urelas

Checks computer location settings

Executes dropped EXE

UPX packed file

Deletes itself

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 22:50

Signatures

Urelas family

urelas

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 22:50

Reported

2024-03-16 22:53

Platform

win10v2004-20240226-en

Max time kernel

157s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ryelru.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bapea.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bapea.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ejxuk.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3116 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\bapea.exe
PID 3116 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\bapea.exe
PID 3116 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\bapea.exe
PID 3116 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 3116 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 3116 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\bapea.exe C:\Users\Admin\AppData\Local\Temp\ryelru.exe
PID 4744 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\bapea.exe C:\Users\Admin\AppData\Local\Temp\ryelru.exe
PID 4744 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\bapea.exe C:\Users\Admin\AppData\Local\Temp\ryelru.exe
PID 3812 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Users\Admin\AppData\Local\Temp\ejxuk.exe
PID 3812 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Users\Admin\AppData\Local\Temp\ejxuk.exe
PID 3812 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Users\Admin\AppData\Local\Temp\ejxuk.exe
PID 3812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Windows\SysWOW64\cmd.exe
PID 3812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Windows\SysWOW64\cmd.exe
PID 3812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\ryelru.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe

"C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe"

C:\Users\Admin\AppData\Local\Temp\bapea.exe

"C:\Users\Admin\AppData\Local\Temp\bapea.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\ryelru.exe

"C:\Users\Admin\AppData\Local\Temp\ryelru.exe" OK

C:\Users\Admin\AppData\Local\Temp\ejxuk.exe

"C:\Users\Admin\AppData\Local\Temp\ejxuk.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

memory/3116-0-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bapea.exe

MD5 433bf3f9b8f05aeb15ca57973814dc65
SHA1 9426861f8fd6fd68b23ce037a713ce4f7ad3fe56
SHA256 14d40da44766ea30a415967986f308f91d8e3973b3a6e76f9039c0911ac52d36
SHA512 722741bec5cf964114112cc27de7045c9de0e5b4c6755cdedafe3d6061c88fc796c5cd6a77b4589c3a0bec02a576726ef2c02b525fd16b7f42de2ec208011003

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 f4bebc8008becd98fe31bd373af1d9e3
SHA1 95ea7fe44330caa7451a0c58776caa51d58cf8a2
SHA256 76ef04bee62deb52b1cb3257063be126d8a0330808ab655bede16bc86e968568
SHA512 d14b812fa6a01a48a80ca84115ccd2a9d462bda5197b3c06d8147af24ad9b9af0aa980b8cd89f116e700c051776b37c1c16317499975199ba2c3232b78a7c1d3

memory/3116-15-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 94af0bedc86fabfb20a3ac847dbc48fe
SHA1 aae6b2f051fd7a13dbde66b6d4823ea6d8b8c154
SHA256 7bae0ce2061162e445660ee0454ccdd5e8e5aab39ab213ef74287135d46b77df
SHA512 2d2c80174c4a281ffb8686e808f24fa1a6ee7283bfe7c32f8506b84bb9c0aa611ba3c404945fb1031a3704e2dff784d48704103d0596085072544d4b28963b95

C:\Users\Admin\AppData\Local\Temp\ryelru.exe

MD5 8764e3fd48076d45b90f239ed75b4884
SHA1 c6d655af1f983c6a4b549c1451f2f8336db5a555
SHA256 18b60040282f75f5328099fe9f1f1b5fa17bd1932521ccc50544b49a9342b325
SHA512 cd8deca6143a6c15a0d9fba81d153d95ea3e7a00511d242ce50ed015bd6f9c598269bc00a93d058148e27259ebbda31816ccf4665d7a358f4c0982ddbd1816a8

memory/3812-25-0x0000000000400000-0x0000000000524000-memory.dmp

memory/4744-24-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ejxuk.exe

MD5 ae440e2dc7019b42193400e93e3518fb
SHA1 06463df1899e18a7be82ec1175df539061471076
SHA256 d651f9dd590548785e15a506dd34758597fabd38087910999ee7aae4b9afeaab
SHA512 4eb2eb7e3c68a2a42a165697086480561b7635915830bee6214611f878b60c1f95a3a8f43d8648ce9872224fcee2588b87475a4206c5e06a7d6ea970331f4452

memory/3964-37-0x0000000000400000-0x0000000000599000-memory.dmp

memory/3812-39-0x0000000000400000-0x0000000000524000-memory.dmp

memory/3964-40-0x00000000024E0000-0x00000000024E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 d706183367d32130c7f086ac59ffaa26
SHA1 8aa08ef5db34905f51d8094fd012d75dfb6b3bc3
SHA256 fa1c12dfe14bb2a499446bc1cc88d135f38315de3f0f3b993b62755dc6a91c3d
SHA512 ce42d1275f46f016d2593ba48ab1a811d3edf5f913193fe26f4ea9e5381422afcea192823fb76b129cd20c3f50a87817b807616765c483322cf310cb43ceec8c

C:\Users\Admin\AppData\Local\Temp\gbp.ini

MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

memory/3964-43-0x0000000000400000-0x0000000000599000-memory.dmp

memory/3964-45-0x00000000024E0000-0x00000000024E1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 22:50

Reported

2024-03-16 22:53

Platform

win7-20240215-en

Max time kernel

148s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\joyfv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\juzol.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2836 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\joyfv.exe
PID 2836 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\joyfv.exe
PID 2836 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\joyfv.exe
PID 2836 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Users\Admin\AppData\Local\Temp\joyfv.exe
PID 2836 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 2836 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe C:\Windows\SysWOW64\cmd.exe
PID 1244 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\joyfv.exe C:\Users\Admin\AppData\Local\Temp\jirodo.exe
PID 1244 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\joyfv.exe C:\Users\Admin\AppData\Local\Temp\jirodo.exe
PID 1244 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\joyfv.exe C:\Users\Admin\AppData\Local\Temp\jirodo.exe
PID 1244 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\joyfv.exe C:\Users\Admin\AppData\Local\Temp\jirodo.exe
PID 2772 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Users\Admin\AppData\Local\Temp\juzol.exe
PID 2772 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Users\Admin\AppData\Local\Temp\juzol.exe
PID 2772 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Users\Admin\AppData\Local\Temp\juzol.exe
PID 2772 wrote to memory of 292 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Users\Admin\AppData\Local\Temp\juzol.exe
PID 2772 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\jirodo.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe

"C:\Users\Admin\AppData\Local\Temp\cf45b2e62fb61b7f2757cf2d1beb08a6.exe"

C:\Users\Admin\AppData\Local\Temp\joyfv.exe

"C:\Users\Admin\AppData\Local\Temp\joyfv.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

C:\Users\Admin\AppData\Local\Temp\jirodo.exe

"C:\Users\Admin\AppData\Local\Temp\jirodo.exe" OK

C:\Users\Admin\AppData\Local\Temp\juzol.exe

"C:\Users\Admin\AppData\Local\Temp\juzol.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2836-2-0x0000000000400000-0x0000000000524000-memory.dmp

\Users\Admin\AppData\Local\Temp\joyfv.exe

MD5 973b29841de25f207b530337264cf6f2
SHA1 8b388d50370c2d811d906a116d74f7e1bef508e3
SHA256 695caedf41fc24f0bba407d4aaa9799b3d6ff74853d3d4c1d913e4f5c2995721
SHA512 c4643bf47c6223fbf1dbf7f3318ef01666b4cdb8d12cf10e14e879bd3c2144ee25cf65f0980148b60e340db4bd501ba039a626eb219afc96952fd0c8e8daa3ea

\Users\Admin\AppData\Local\Temp\joyfv.exe

MD5 ea985d70a6187270f676151b533816dc
SHA1 72ca94cc4431a8d466db70002cdc408630cfd694
SHA256 40e5b437c904b825f7a60a4fef6035cd9b74dbe23857003f87c9f08cbec42498
SHA512 7940d27fd2975ed2e1276de27e4f2f0248dac245575753f07e41a07693024eb213087805a8a3e0272ce5c49d143e4ba11690ea68cb864726003d2754d74bd3fe

memory/2836-21-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 631a185b769cb4bdf45a58d813301eb0
SHA1 3cb647176f9e53be55d08f21999adbc924153c4e
SHA256 12369188820b2923beca0771dea9f539ac2e27bb4745d9083eb733a3a2eb3799
SHA512 37e50e60659df586080e126d49e412f908931eda58a4e95878ea2e9efc851460145d53c889aec9016d2653e4742709624b10b698da60eb3b9db510d840927e12

memory/2836-12-0x0000000002FE0000-0x0000000003104000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 94af0bedc86fabfb20a3ac847dbc48fe
SHA1 aae6b2f051fd7a13dbde66b6d4823ea6d8b8c154
SHA256 7bae0ce2061162e445660ee0454ccdd5e8e5aab39ab213ef74287135d46b77df
SHA512 2d2c80174c4a281ffb8686e808f24fa1a6ee7283bfe7c32f8506b84bb9c0aa611ba3c404945fb1031a3704e2dff784d48704103d0596085072544d4b28963b95

memory/1244-22-0x0000000000400000-0x0000000000524000-memory.dmp

memory/1244-34-0x0000000003750000-0x0000000003874000-memory.dmp

memory/1244-33-0x0000000000400000-0x0000000000524000-memory.dmp

memory/2772-36-0x0000000000400000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

MD5 48ff01f7b66b7b85248117aa627359b4
SHA1 968ab16d95eb4dc6ac5863a8868a652b78015e61
SHA256 303a26b3e5398ced0eaa717cbe5d1aa73d7fba78e24145173463969686548059
SHA512 922b7d665cfdac62463e36a732119c649bf3ba1d40495e457362df17978c23914f6d47351cf9286d9260e7b5fd370b0676c238181f5681d191c0dcfd49dcfcf9

C:\Users\Admin\AppData\Local\Temp\juzol.exe

MD5 878fad572893a0d39105db1311a6f1ad
SHA1 1a3e05fe236cf12f9ea7aecc790f28bc677ec2e7
SHA256 f2b2371d2cfeb5604e3b17545ef5e8e9d7525c60a2287fb0225a21f855e2f107
SHA512 0749e433191218242f5bd5aa4fa4da62016fe6debe46576157370f1740209c455c91b9ec44cd646b797cf44e10556e09035625ee73d6149fe8708ec2415ee743

memory/2772-53-0x0000000003DE0000-0x0000000003F79000-memory.dmp

memory/2772-52-0x0000000000400000-0x0000000000524000-memory.dmp

memory/292-54-0x0000000000400000-0x0000000000599000-memory.dmp

memory/292-55-0x00000000003B0000-0x00000000003B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\gbp.ini

MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

memory/292-59-0x0000000000400000-0x0000000000599000-memory.dmp

memory/2772-61-0x0000000003DE0000-0x0000000003F79000-memory.dmp

memory/292-62-0x00000000003B0000-0x00000000003B1000-memory.dmp