urelas | 90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
Size 487KB
Sample240327-18gecscf39
SHA256 90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70
MD5 4cc6085dcca73760b3dbb36e27dddca7
SHA1 0293e56e79824f83c0044739ed5b98dcf97fd75e
SHA512 6c14d82ec29934648fdcaa2d38019fa2cd3ba7653ae7e27b6ed0d0251807751bd2e952d42e786a771cd61ed2e4d0f1c3f615ad61c22d3ae0f4df2eb5e536152a
SSDEEP 12288:Vpbvglu0agWSFnxAEwKyLH8l+O9H6s2si2XfxKTbek:VpbXi5xzFUBaazsiofx8N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2572	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2944	penoi.exe
2680	gigem.exe

Loads dropped DLL 2 IoCs

pid	Process
2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
2944	penoi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe
2680	gigem.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2944	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	28
PID 2180 wrote to memory of 2944	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	28
PID 2180 wrote to memory of 2944	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	28
PID 2180 wrote to memory of 2944	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	28
PID 2180 wrote to memory of 2572	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	29
PID 2180 wrote to memory of 2572	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	29
PID 2180 wrote to memory of 2572	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	29
PID 2180 wrote to memory of 2572	2180	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	29
PID 2944 wrote to memory of 2680	2944	penoi.exe	33
PID 2944 wrote to memory of 2680	2944	penoi.exe	33
PID 2944 wrote to memory of 2680	2944	penoi.exe	33
PID 2944 wrote to memory of 2680	2944	penoi.exe	33

C:\Users\Admin\AppData\Local\Temp\90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
"C:\Users\Admin\AppData\Local\Temp\90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\penoi.exe
  "C:\Users\Admin\AppData\Local\Temp\penoi.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\gigem.exe
    "C:\Users\Admin\AppData\Local\Temp\gigem.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 6be86af738c6cca21f169a4886fa9bee5edb6985c7916cc467ad356dcfc3a905
MD5 7ae61827dd88945977b6052eb0937157
SHA1 a6be0220322c2d25a2ce03a1da6e60992a7208fd
SHA512 eb6e488b20c659d4a4df3684c80eac8d22c872ce7053203a5086b634c824217bd4a982ee3bf6055feeb13f1ce0842754b1a8e723fae686726ff6a711b6c5495d
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 eb25d4505e8af24647009ed354744301b8beced2b66e36413fee815c69c576e9
MD5 db072697225358e30468f2d458bec4d6
SHA1 94fe48c6c349a299c508de06431cc227ef9e8f60
SHA512 78b6dbb835f9f04d82300ad6fd74ea063c2154241794fa355d9537755b6097eca43d46c1a616fbdbac1d37bed916dd895055a5aa7307c58ccd2506a1a78965a2
MD5 SHA1 SHA512

Submit Download

gigem.exe

Path \Users\Admin\AppData\Local\Temp\gigem.exe
Size 217KB
SHA256 5cc646d8d0c66c9f995ead04e38f5f2b36bcca04ec53ffb99f84e73908260b3d
MD5 6a6aada7394f0392bf3882507211ac3d
SHA1 5d7a16e9516bfdad1bd1190b5e60b7d805740d44
SHA512 c8cd3bbc28feeb3282ebafcf23cc7123f79f3384b41a2607909ac29ef350d199cfe739a7d40d0f69caa27933be5dbb0dccc365e0617ec79ca9fc7c86d86a038a
SSDEEP 6144:uwJ8wd7JF1612h9DYAJn1L+BD8X6Qfspp9:uxwd81ADYADL+8X6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

penoi.exe

Path \Users\Admin\AppData\Local\Temp\penoi.exe
Size 487KB
SHA256 bbba707db183d0dc49c194471740eee72ec1a2c160941e4178fa47e2856babc5
MD5 de732e7baafcc6fb1da8dcc43792ad7b
SHA1 9c2ddc7eb8e7381c0b05dd2a468d17a9b845fb67
SHA512 7e3cda0526bcbf10ceb9dce1c54fcc1c4f8d153789f828813180fa9bb223b9fd9a08ef4fdbd6efc474604d353b74c0ed667030414be9ec6a5d1fd7c329026f20
SSDEEP 12288:Vpbvglu0agWSFnxAEwKyLH8l+O9H6s2si2XfxKTbee:VpbXi5xzFUBaazsiofx8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2180-0-0x0000000000FD0000-0x0000000001055000-memory.dmp

Download

memory/2180-9-0x0000000002690000-0x0000000002715000-memory.dmp

Download

memory/2180-18-0x0000000000FD0000-0x0000000001055000-memory.dmp

Download

memory/2680-32-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2680-29-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/2680-30-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2680-33-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2680-34-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2680-35-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2680-36-0x0000000001080000-0x0000000001134000-memory.dmp

Download

memory/2944-27-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Download

memory/2944-28-0x0000000003580000-0x0000000003634000-memory.dmp

Download

memory/2944-16-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Download