urelas | 2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe
Size 442KB
Sample240323-xnsecade8w
SHA256 2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f
MD5 e6f5513da83033381983461d1d2260dd
SHA1 a8e3ed2cd827ccd385e5e6daaa1b9021c92bcd29
SHA512 f8ada9f116e68aeba0ff7f8c64572f7fa1427f18ba3d4a506e2cb558120afebf2c3a25c4f4250fad063826d101b1c0943682d277a5fd3981d92e6fb55b6ead76
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdKbe:vMpASIcWYx2U6hAJQnXK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	vooll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	myrowe.exe

Executes dropped EXE 3 IoCs

pid	Process
2456	vooll.exe
4596	myrowe.exe
1376	ryyfl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe
1376	ryyfl.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2456	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	98
PID 1128 wrote to memory of 2456	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	98
PID 1128 wrote to memory of 2456	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	98
PID 1128 wrote to memory of 3632	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	99
PID 1128 wrote to memory of 3632	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	99
PID 1128 wrote to memory of 3632	1128	2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe	99
PID 2456 wrote to memory of 4596	2456	vooll.exe	101
PID 2456 wrote to memory of 4596	2456	vooll.exe	101
PID 2456 wrote to memory of 4596	2456	vooll.exe	101
PID 4596 wrote to memory of 1376	4596	myrowe.exe	115
PID 4596 wrote to memory of 1376	4596	myrowe.exe	115
PID 4596 wrote to memory of 1376	4596	myrowe.exe	115
PID 4596 wrote to memory of 32	4596	myrowe.exe	116
PID 4596 wrote to memory of 32	4596	myrowe.exe	116
PID 4596 wrote to memory of 32	4596	myrowe.exe	116

C:\Users\Admin\AppData\Local\Temp\2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe
"C:\Users\Admin\AppData\Local\Temp\2f0c8345c4fc15bcb934d92d713604b6e2050bef93005e9de826a31036778e9f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\vooll.exe
  "C:\Users\Admin\AppData\Local\Temp\vooll.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\myrowe.exe
    "C:\Users\Admin\AppData\Local\Temp\myrowe.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\ryyfl.exe
      "C:\Users\Admin\AppData\Local\Temp\ryyfl.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:32
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 0b69ed8a6112e338197aa67e774368513cdbb3cd889d713a52942373f7b4a781
MD5 726a4f543b98aac3e4079eaa824191d8
SHA1 d09639e1b8c22091b924878b3b111b6967419265
SHA512 c9fd174a9304e1bda5373c77dd3572294b26e9bf179a79b498df4728abce6ce247ef43c61c67bf3049d6f16153ddef1efdff206907cb4e5fccb52d00e272e71b
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 9c8c40877840d0507a373c4068b0408ba0bed3dc6fb05269bc8855785cb3c438
MD5 07abca0ac7746085489b0c16c0f3f742
SHA1 e1baa5cae79ffe5f96eadda67274f7480c6879b0
SHA512 823abd9f1bb51e13b149b30d7c50c3f060d1d8bc0beefd4047f5154583df94e05d5741d15acd1ea37278312f55570f4a128aa13064c570e735b1f8b724db2102
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 87b80d69d392f60f0a58cb7650055451ba18df85602b60db0829ef4c2c1a251a
MD5 f924cf154d94ed669767a63df85a0e27
SHA1 eeb9796d1073a8d72ca8554c63b5882bcfaee7eb
SHA512 448af4b09be30b0690099487243a8db2957be7f421af62a6b9d5b1d77d9d00b0e24d7feba2f51fa155aff362d527168c7d69648f1bda845963f000b68724dc3b
MD5 SHA1 SHA512

Submit Download

myrowe.exe

Path C:\Users\Admin\AppData\Local\Temp\myrowe.exe
Size 442KB
SHA256 6679f87ee392f0fb836b73ab3281de213fd96412fdcbfc38b7d1cbf6d3d672a7
MD5 a83c515ecf436fd88043b74ce8583603
SHA1 a4d197712b029e9d0843c6d34967817b904c149e
SHA512 86ec0d0c662cf2620cac9166b53fe70dec821fcf32e78016bd02dd72a1927a459d738cc0cda94da3f35882b5345cd76dad5171f6e5ff110709b79d42ebe9dd0c
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdKbc:vMpASIcWYx2U6hAJQnXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ryyfl.exe

Path C:\Users\Admin\AppData\Local\Temp\ryyfl.exe
Size 223KB
SHA256 f94d6f9b5a85b4dee2c232105fc007334695206cea982f8b8169c9fd689f5c2b
MD5 a593c9a8a5d5b940e84a276b77bf272f
SHA1 da0cf9a6f1afd35ac33223987073ae99ba2add1d
SHA512 0058020d724d7de268816a4ef00130966d58bc221660ce566a5f3f2530b801bbc2e0d4cf1d6b52624d6ebfa8fa692065be5371c906a125654056addb986a95ec
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p31:unFhSIkAyDgjtS/FZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vooll.exe

Path C:\Users\Admin\AppData\Local\Temp\vooll.exe
Size 442KB
SHA256 aa2bee44b26a73b16b87b0a534c78d492c58f4df3409ee582586cfec6b094b59
MD5 4d9b59814b9c2c3c5fff3f6905d7caf1
SHA1 811ed585dd92315f813744c95d5e72ce38c19d02
SHA512 86684ecfab61fe28bc0889cc35aa00dc7961c894e2fe211a9d8c1c4d26d404988ee11d56977cfdc505120a6301634c8a076f06e2f6819d599fb098cb8dfd9059
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdKb6:vMpASIcWYx2U6hAJQnXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1128-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1376-36-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1376-34-0x0000000000720000-0x00000000007C0000-memory.dmp

Download

memory/1376-41-0x0000000000720000-0x00000000007C0000-memory.dmp

Download

memory/1376-42-0x0000000000720000-0x00000000007C0000-memory.dmp

Download

memory/1376-43-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1376-44-0x0000000000720000-0x00000000007C0000-memory.dmp

Download

memory/1376-45-0x0000000000720000-0x00000000007C0000-memory.dmp

Download

memory/2456-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4596-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download