urelas | 5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf

Analysis

max time kernel
157s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe
Size 488KB
Sample240317-y4bbfafa49
SHA256 5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf
MD5 b3600c420239a988c5835f395509852b
SHA1 11fd193c96578318fbbbebc1401bf0db0573b358
SHA512 02e50d8100a61f458d931796a3cf8716a497e7e6a45fb61cebe946fa5185183d7f8d01e607a56e1f317b950c8b84d51def49f75c404959d56337d89bbdd8f285
SSDEEP 12288:xpbfVlu0agWfZlnxgmEpZGsrUs99uDEq5EGDFhId:xpbGRZxSfGCUs99hq5Jy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	qigoj.exe

Executes dropped EXE 2 IoCs

pid	Process
3956	qigoj.exe
5032	sudil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe
5032	sudil.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3956	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	99
PID 452 wrote to memory of 3956	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	99
PID 452 wrote to memory of 3956	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	99
PID 452 wrote to memory of 3044	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	100
PID 452 wrote to memory of 3044	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	100
PID 452 wrote to memory of 3044	452	5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe	100
PID 3956 wrote to memory of 5032	3956	qigoj.exe	113
PID 3956 wrote to memory of 5032	3956	qigoj.exe	113
PID 3956 wrote to memory of 5032	3956	qigoj.exe	113

C:\Users\Admin\AppData\Local\Temp\5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe
"C:\Users\Admin\AppData\Local\Temp\5d34c1fa9a4b848903798ab0660b2758bd330336bea28c4044cfa087cc67decf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\qigoj.exe
  "C:\Users\Admin\AppData\Local\Temp\qigoj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Users\Admin\AppData\Local\Temp\sudil.exe
    "C:\Users\Admin\AppData\Local\Temp\sudil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 ed850577223e6e4547ae44a1e7300aae4f65991bc8ddc115e0d10b1811436dae
MD5 fa6436708d81f6c5b45736c50df33bfd
SHA1 2b0c8e02ad89d1691164f17e1c591236dd21e54e
SHA512 5213576ed5ffbb78327bb71e6f5482ae3954d757339fd24a1593361459ac7fcd68d2d8c991392e0ab7eb8f95c0b5158e18e44ab98844ee64aa6f034e4a11f7de
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 dea16d297e64a20a676350e91eea1785ae5bee0dd8390d2111d51e1f4e896cb7
MD5 b4f64beeefbb9b3c065a3b316dc3d801
SHA1 8ceb18076b92d5a1612ef533425255c9ae5a5886
SHA512 764ac90db729bf40b085cc596606af7f3ad0303e5decc29a9e10a4de29af652f7a2b958fd15af52ef2dee0f6acce8559ff3a8a49ff0200282509619ec62b22ad
MD5 SHA1 SHA512

Submit Download

qigoj.exe

Path C:\Users\Admin\AppData\Local\Temp\qigoj.exe
Size 488KB
SHA256 31387a3515737b631edde0ffadac4e104aacd61e5083c07581ecbcca12b4cd0e
MD5 9da86a73c57897c49b9c35136526d82d
SHA1 1f35fd32e83f084bc61c7a072580216871e5ff08
SHA512 e776925dce285a3551fe820857ee00d8b220cc1ad7fa7561232f9b52a86995dea2f9114462e1820de68790fcec4f23fc2bbd99673267bac167cdd61b01f3a1ae
SSDEEP 12288:xpbfVlu0agWfZlnxgmEpZGsrUs99uDEq5EGDFhI5:xpbGRZxSfGCUs99hq5JW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sudil.exe

Path C:\Users\Admin\AppData\Local\Temp\sudil.exe
Size 179KB
SHA256 b4ea4a0411cb7a6b3b4eb3bcff674de459aa3d376647140ae80a0908c8a90b69
MD5 509835eb4393738d5f91f611b7a6c73c
SHA1 4a4f12d7d935eaf67e756ac98dd9e3b2dbce33c8
SHA512 b78e6b5b4236d67e375aa5a22711c789447c56bbbcb0afbfd7e66a4459ff891b034175dd2219fda616a8e167413935318032e65277a514d13e1b5f1bb81d8dcb
SSDEEP 3072:MFmxsczyRrAO75U+31DjsAZ8yTyZMCAeABYDgcvZd6l1zPDpcDKJJ3RnQFH:MQ2RrAO7zBjsAjTyZMCAeABYlGz6KJ3E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-1-0x0000000000EF0000-0x0000000000F76000-memory.dmp

Download

memory/452-0-0x0000000000EF0000-0x0000000000F76000-memory.dmp

Download

memory/452-17-0x0000000000EF0000-0x0000000000F76000-memory.dmp

Download

memory/3956-19-0x0000000000190000-0x0000000000216000-memory.dmp

Download

memory/3956-12-0x0000000000190000-0x0000000000216000-memory.dmp

Download

memory/3956-13-0x0000000000190000-0x0000000000216000-memory.dmp

Download

memory/3956-28-0x0000000000190000-0x0000000000216000-memory.dmp

Download

memory/5032-27-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5032-31-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5032-32-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5032-33-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/5032-34-0x0000000000400000-0x00000000004BF000-memory.dmp

Download