urelas | 7d2fa6d12eef3a00a709d03ca80fcc726f3a62d616f8fb63911a0de365ff1cf0

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce60aea493418be8c5c9cea6c309abc1.exe
Size 555KB
Sample240316-sn7f2sdf3y
SHA256 7d2fa6d12eef3a00a709d03ca80fcc726f3a62d616f8fb63911a0de365ff1cf0
MD5 ce60aea493418be8c5c9cea6c309abc1
SHA1 edca862f572d5b8dc793861c685eadbf7e22ec80
SHA512 1bec20ff5e74c2f70d051a9af080234fa4e164ab45f859882f78670d5a2e04a2a3e925dfecbc02e5041cd1d55ac8087e26311b5f7b2db234020494bef9054639
SSDEEP 12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEyk:znPfQp9L3olqFk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan upx

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bugir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ce60aea493418be8c5c9cea6c309abc1.exe

Executes dropped EXE 2 IoCs

pid	Process
4760	bugir.exe
4244	seyff.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3884-0-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/files/0x0007000000023268-6.dat	upx
behavioral2/memory/3884-13-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4760-16-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4760-27-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe
4244	seyff.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4760	3884	ce60aea493418be8c5c9cea6c309abc1.exe	99
PID 3884 wrote to memory of 4760	3884	ce60aea493418be8c5c9cea6c309abc1.exe	99
PID 3884 wrote to memory of 4760	3884	ce60aea493418be8c5c9cea6c309abc1.exe	99
PID 3884 wrote to memory of 1136	3884	ce60aea493418be8c5c9cea6c309abc1.exe	100
PID 3884 wrote to memory of 1136	3884	ce60aea493418be8c5c9cea6c309abc1.exe	100
PID 3884 wrote to memory of 1136	3884	ce60aea493418be8c5c9cea6c309abc1.exe	100
PID 4760 wrote to memory of 4244	4760	bugir.exe	113
PID 4760 wrote to memory of 4244	4760	bugir.exe	113
PID 4760 wrote to memory of 4244	4760	bugir.exe	113

C:\Users\Admin\AppData\Local\Temp\ce60aea493418be8c5c9cea6c309abc1.exe
"C:\Users\Admin\AppData\Local\Temp\ce60aea493418be8c5c9cea6c309abc1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\bugir.exe
  "C:\Users\Admin\AppData\Local\Temp\bugir.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\seyff.exe
    "C:\Users\Admin\AppData\Local\Temp\seyff.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 276B
SHA256 d7d5f7e7d7a7ed5b5eeb3be8e60c839c2bc189049b08cc8ae39ceb9e2e1a9ce6
MD5 8b81a02dbb9a217dfa862d624fe2b371
SHA1 56e0cbb84a429d933208d1a16492352e774f99ab
SHA512 69b2b4545045c67a4a02e51bd2c755d4759446ac214e385c4d2e29888680a827f10654f9b3aebff9ac51f42bb9f5a0e4b325b21bfc1a048f55b5e67c8908a125
MD5 SHA1 SHA512

Submit Download

bugir.exe

Path C:\Users\Admin\AppData\Local\Temp\bugir.exe
Size 555KB
SHA256 18ab215e5ab55990c357788a3c11591dbfd12e7bf7388f91726a0686a225ab34
MD5 e37b6db7373b45717c87c40e632af403
SHA1 089d3a53c66ab5036fd9dd5886f77075cfdcf27c
SHA512 a23daf499906a1ba57904cd5dc49e3876c32b8bdc3544ee0ced524f00c8a7abacd0dfa33672658bd72bd72a018fad25545f424986c3a71b87c77febd3f8430c0
SSDEEP 12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEyT:znPfQp9L3olqFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8b31f864e76181d2eee410babe8263d67d65ff5cae43f1725b1de72b2195c6f8
MD5 b273fb689b93215a430dfc9070a1d924
SHA1 deb02436bb8c904bb6a6c0936b02f73e8d0ecc91
SHA512 7a9b9c8251610a90a50d859ecd45219d001096dd9e8525fc2555914c6c37c8ae6892199fc35a53f5265b3de1fc93eec2d1f049de01f18a150be67b86d58fd9ad
MD5 SHA1 SHA512

Submit Download

seyff.exe

Path C:\Users\Admin\AppData\Local\Temp\seyff.exe
Size 194KB
SHA256 9880bfa323bc7181dc43c0535d37a5bf11d00a27b4f8a1a3e70b3da89dc9f7f8
MD5 201a69e1ab1b402f4c17253ec5c6797e
SHA1 8810f000d8592f26cda54c0e5410958f9fe2bb09
SHA512 7e9e6be8b3ffa1ce9244eb2882d249abbbba6e1cb440623c84422bb8e14b7fac3f706d6257105ca9e3299cf872465e98bfd7c54dfe7fe42e381f6e045180602a
SSDEEP 3072:NcqP9ytWHC2SJ1LNvnRqIregU6OaoY7VBL/pia1weyqEWDRmTUSt+m7hC:NcGeB2SJ1Laceg7fpBbpia1wkk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3884-13-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/3884-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4244-26-0x00000000001D0000-0x00000000001D2000-memory.dmp

Download

memory/4244-24-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4244-29-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4244-30-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4244-31-0x00000000001D0000-0x00000000001D2000-memory.dmp

Download

memory/4244-32-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4244-33-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4244-34-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/4760-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4760-27-0x0000000000400000-0x00000000004B6000-memory.dmp

Download