urelas | 4b0dca6dea503388ed868c1a1ab38083e32909b780a8e218d062af2923aab5b5

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce5405f149e80d6c4a71914dbbeda0c9.exe
Size 400KB
Sample240316-r71beafb67
SHA256 4b0dca6dea503388ed868c1a1ab38083e32909b780a8e218d062af2923aab5b5
MD5 ce5405f149e80d6c4a71914dbbeda0c9
SHA1 6263be965dfc0a9669c267798248aa42d02daa91
SHA512 9ab1659520f5b87d292e0ab73c8e75a2bedc3be43064701618bf07a7528de4cbf1fc904818059576ea3b82e22453c7e6edf310eab4940f67e9cc8287c09921d9
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBroh8:8IfBoDWoyFblU6hAJQnO6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	tinezy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	ce5405f149e80d6c4a71914dbbeda0c9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	yzcyg.exe

Executes dropped EXE 3 IoCs

pid	Process
1236	yzcyg.exe
1196	tinezy.exe
4536	bosoo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe
4536	bosoo.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1236	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	88
PID 1616 wrote to memory of 1236	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	88
PID 1616 wrote to memory of 1236	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	88
PID 1616 wrote to memory of 2840	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	89
PID 1616 wrote to memory of 2840	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	89
PID 1616 wrote to memory of 2840	1616	ce5405f149e80d6c4a71914dbbeda0c9.exe	89
PID 1236 wrote to memory of 1196	1236	yzcyg.exe	91
PID 1236 wrote to memory of 1196	1236	yzcyg.exe	91
PID 1236 wrote to memory of 1196	1236	yzcyg.exe	91
PID 1196 wrote to memory of 4536	1196	tinezy.exe	108
PID 1196 wrote to memory of 4536	1196	tinezy.exe	108
PID 1196 wrote to memory of 4536	1196	tinezy.exe	108
PID 1196 wrote to memory of 4104	1196	tinezy.exe	109
PID 1196 wrote to memory of 4104	1196	tinezy.exe	109
PID 1196 wrote to memory of 4104	1196	tinezy.exe	109

C:\Users\Admin\AppData\Local\Temp\ce5405f149e80d6c4a71914dbbeda0c9.exe
"C:\Users\Admin\AppData\Local\Temp\ce5405f149e80d6c4a71914dbbeda0c9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\yzcyg.exe
  "C:\Users\Admin\AppData\Local\Temp\yzcyg.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\tinezy.exe
    "C:\Users\Admin\AppData\Local\Temp\tinezy.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\bosoo.exe
      "C:\Users\Admin\AppData\Local\Temp\bosoo.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 276B
SHA256 89e9975f58e968239ad6afae70d2414dafa8dc47a6185f2eddc3c96ec2e71e54
MD5 a50f28269ec216fac4e0ee986ba69f8a
SHA1 b90615c2b8fcbba68ca375911520697a2d88fb9f
SHA512 22f6fafb1aa7cb190e840d9525e06493bc2652e4f21a82392f300a3008763d275ed17bd3dbf76ef1555c721109c1b16d66f1efdbbc7c40ecc55d49380d17e9fc
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 67b3f85f11c924dc81070abd14a60c9074bc3821a75090c7d76adb53cfa17756
MD5 b6830c3503c37e62861d346d8d79d15a
SHA1 8fa594fc7668dee2e143b52b567d73a6cd3756ca
SHA512 edfe368f3a32de3415d143ca0b6c92ecb81d808ef0087b296f111cb4a1cfc647dff8c96f345972f9bebb74ee05b6ea9df67b163713cc907729f22f8cf946f59a
MD5 SHA1 SHA512

Submit Download

bosoo.exe

Path C:\Users\Admin\AppData\Local\Temp\bosoo.exe
Size 223KB
SHA256 b7e1b59f3014b26fcc6a03545db7d7f53bfdd5175a7e6355d37e6cb63afa290b
MD5 e9016b0ccbc750e225ca832470075f7a
SHA1 fbed46d144f578282491253a1a2749a2e256cc5d
SHA512 1605252eadbaceab247d71382231d7e8ae9c40c2e6e286d00b0e500d94737bf3b542d5d8e58777ab35ef22f26ff058dddc6822dfba94add1d7d92e3a3daec2d4
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3H:unFhSIkAyDgjtS/FZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a51b8e5ac08040dd410a81bf9981e936674528aed68af1c0b300b57bf05b7f0a
MD5 33b32b9174b2f5d62babbe2b1c1700d6
SHA1 eccf2d5182f2505fde20d942f80bfbd4278a9912
SHA512 df9ab1fd4f0e4ef4888c3281b1ca593f300b290098f8c5e4982c3047409c91de197b1351f8a92ed571dd6bd78639d2815add8a02bc855b0a436020ebbb5302f5
MD5 SHA1 SHA512

Submit Download

tinezy.exe

Path C:\Users\Admin\AppData\Local\Temp\tinezy.exe
Size 401KB
SHA256 394d6d5acda37c796de5cfa69e59b86136c52bace75846256decf6721bdd2ed6
MD5 0f288525935db3fc3819f8693de0b082
SHA1 939ca6d4016d9c003ccb8c10d8a40c15181a11c4
SHA512 6657f72bb3de48803c63109b221c69f4abbcd72a03ca4f7b76f0f520e060918d61853cfa8f908eb156e9e1bb577089e17647c9fc52eca3e39505cb2ba8c726e2
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohr:8IfBoDWoyFblU6hAJQnOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzcyg.exe

Path C:\Users\Admin\AppData\Local\Temp\yzcyg.exe
Size 400KB
SHA256 599b1fb740a2ce4d4c08ee09550424b0e92b514fddc76c0030236b724fbb2135
MD5 ace145986997234e3f0a5d49336b4923
SHA1 6dfe4046314c3c4c260c61b2d67fcebc16243904
SHA512 7b18b551057ffe39f3c7d29acf8e71657ed31eebe5e244042f0b1622691d7b04bcb5cc206e8813f57beefffc3bcfa9dcca1f745f41503d0af3bca4a934badacc
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohf:8IfBoDWoyFblU6hAJQnOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1196-40-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1196-26-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1236-25-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1236-12-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1616-15-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1616-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4536-39-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/4536-38-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download

memory/4536-43-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download

memory/4536-44-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download

memory/4536-45-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download

memory/4536-46-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download

memory/4536-47-0x0000000000FE0000-0x0000000001080000-memory.dmp

Download