urelas | d5423ea5ffa96212ba2c4ad1b48768ebdc20e23ec94876f4a8c799559cd0df32

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9b10af138b5864bd6b6ec17d987fe24.exe
Size 509KB
Sample240316-debwfsad3x
SHA256 d5423ea5ffa96212ba2c4ad1b48768ebdc20e23ec94876f4a8c799559cd0df32
MD5 c9b10af138b5864bd6b6ec17d987fe24
SHA1 21e8848f9c502c0eabc5edbd56bd69e0cf25e270
SHA512 07c5d294e299dcae3a6fc3be443f24b94caed15b293176a916e57ccc87d355919578c9b7bbd40c334a595b13b27c7f81e0b63683ee0ecef22b6bd42a80de6bb4
SSDEEP 12288:kdBNKTCqqwXCcdgT89+MvA+BisqYpxHtM/:kLjQC+fs0C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	c9b10af138b5864bd6b6ec17d987fe24.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	muruh.exe

Executes dropped EXE 2 IoCs

pid	Process
4612	muruh.exe
3508	qouzf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe
3508	qouzf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4612	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	91
PID 2616 wrote to memory of 4612	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	91
PID 2616 wrote to memory of 4612	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	91
PID 2616 wrote to memory of 4464	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	92
PID 2616 wrote to memory of 4464	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	92
PID 2616 wrote to memory of 4464	2616	c9b10af138b5864bd6b6ec17d987fe24.exe	92
PID 4612 wrote to memory of 3508	4612	muruh.exe	112
PID 4612 wrote to memory of 3508	4612	muruh.exe	112
PID 4612 wrote to memory of 3508	4612	muruh.exe	112

C:\Users\Admin\AppData\Local\Temp\c9b10af138b5864bd6b6ec17d987fe24.exe
"C:\Users\Admin\AppData\Local\Temp\c9b10af138b5864bd6b6ec17d987fe24.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\muruh.exe
  "C:\Users\Admin\AppData\Local\Temp\muruh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\qouzf.exe
    "C:\Users\Admin\AppData\Local\Temp\qouzf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 276B
SHA256 6a51524892f4a33b7afb5817dd6f5e3e73b5942a1f17aca2726110d3543ad7d6
MD5 231a7c158e918681bd938481813bacf4
SHA1 dabed20e69b35a50dd880395b176b3ce2db97fa7
SHA512 b4ebc4299844c388b2cfcd881e61209e5bb16a177eb3fc108f5e545b761b3b297800179d6d0904347feb16edbd18ec5ae4bd31aa52f85f31e4f253a21dbefc12
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 6ccf80abb030d65aba0747c3920be558d31025d2a01f5141b6bc505e1c7653ad
MD5 ac242b378af5d27ed5bc3027dab7ddcb
SHA1 a29344b9c7091ca000e355fc4c0faf2e5612e919
SHA512 ba1e8f1840994ef9439759fcbb2381d1c0740d7d1888f5f314cdc8875fc9b31bfd936bc903f5d2a21d5d15b562d464e77302582cadb92f3b56dcb482541f58a6
MD5 SHA1 SHA512

Submit Download

muruh.exe

Path C:\Users\Admin\AppData\Local\Temp\muruh.exe
Size 509KB
SHA256 85d9d0b7bb091d4023a9f7df44cc87c43678e197ec6dd9884cf52a0211f49031
MD5 7bf3fa3e7886931f8afc86f8468a779a
SHA1 dbc61f108b3f592ead7104ceea4c91840db2ab19
SHA512 4be5c6805a1ad690a314f314558097e6960796ffe786bcbac9090c09b16b730466d827e876f74e97fa27079f81bd4763c30d59a6ae2b0fb7e5c08f341b243eb2
SSDEEP 12288:kdBNKTCqqwXCcdgT89+MvA+BisqYpxHtM0:kLjQC+fs0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

qouzf.exe

Path C:\Users\Admin\AppData\Local\Temp\qouzf.exe
Size 241KB
SHA256 a92a617cbd4303b40590cc2891d9654e5ec46f1b73970373e0d840da9cfa7298
MD5 46470b2da12ed69c841d8ccffb894b3f
SHA1 b1b59fb501adcce37771399df0ff8aabc21a4a20
SHA512 fe8def4bf7f426363a041828f585759cedc8d403fe6413acabf1df528befd1c688402cd6dc4e3175edebbb62f3403ee9429cdd334e8ac2528d9371b42a6f8ea2
SSDEEP 3072:CZaJLbIOtG2IOQuuEK3piuGImP/7uxvNujW2UP75ioKueyCL9esEqdbNW2:CZatbIYbIOpKZiuGpuxvNVOueyCLZ5W2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2616-0-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/3508-24-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/3508-25-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3508-27-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/3508-28-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/3508-29-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/3508-30-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/3508-31-0x00000000003D0000-0x0000000000486000-memory.dmp

Download

memory/4612-13-0x0000000000400000-0x0000000000484000-memory.dmp

Download