urelas | 90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
Size 487KB
Sample240327-18gecscf39
SHA256 90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70
MD5 4cc6085dcca73760b3dbb36e27dddca7
SHA1 0293e56e79824f83c0044739ed5b98dcf97fd75e
SHA512 6c14d82ec29934648fdcaa2d38019fa2cd3ba7653ae7e27b6ed0d0251807751bd2e952d42e786a771cd61ed2e4d0f1c3f615ad61c22d3ae0f4df2eb5e536152a
SSDEEP 12288:Vpbvglu0agWSFnxAEwKyLH8l+O9H6s2si2XfxKTbek:VpbXi5xzFUBaazsiofx8N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	nuowf.exe

Executes dropped EXE 2 IoCs

pid	Process
3592	nuowf.exe
4412	gexaz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe
4412	gexaz.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3592	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	89
PID 4260 wrote to memory of 3592	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	89
PID 4260 wrote to memory of 3592	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	89
PID 4260 wrote to memory of 4448	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	90
PID 4260 wrote to memory of 4448	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	90
PID 4260 wrote to memory of 4448	4260	90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe	90
PID 3592 wrote to memory of 4412	3592	nuowf.exe	100
PID 3592 wrote to memory of 4412	3592	nuowf.exe	100
PID 3592 wrote to memory of 4412	3592	nuowf.exe	100

C:\Users\Admin\AppData\Local\Temp\90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe
"C:\Users\Admin\AppData\Local\Temp\90216cd71effbdb0628dacb822bd7dc49ce0bf989689e95ad928632c30800d70.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\nuowf.exe
  "C:\Users\Admin\AppData\Local\Temp\nuowf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\gexaz.exe
    "C:\Users\Admin\AppData\Local\Temp\gexaz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 6be86af738c6cca21f169a4886fa9bee5edb6985c7916cc467ad356dcfc3a905
MD5 7ae61827dd88945977b6052eb0937157
SHA1 a6be0220322c2d25a2ce03a1da6e60992a7208fd
SHA512 eb6e488b20c659d4a4df3684c80eac8d22c872ce7053203a5086b634c824217bd4a982ee3bf6055feeb13f1ce0842754b1a8e723fae686726ff6a711b6c5495d
MD5 SHA1 SHA512

Submit Download

gexaz.exe

Path C:\Users\Admin\AppData\Local\Temp\gexaz.exe
Size 217KB
SHA256 7aa73a5c5ed579f2752f91aacdee694a52148afcd96640273d5d34b743505980
MD5 18ee5b6b19dad289ffc2ecc8eb9eb242
SHA1 b7101319358c34d07f9c73d3e57b7c3dc6dc1524
SHA512 ddd6bf7a17fb46ac56bab3ba25e8bdc05f5fcde2870a0b2a523febd3d7d513e5064b2aa0430f52ab63477630bed1db85f9982b0ae0e076f39538c41bb43e3e03
SSDEEP 6144:uwJ8wd7JF1612h9DYAJn1L+BD8X6Qfsppp:uxwd81ADYADL+8X6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b5572a9e17da0487dfde9695dc7bdaf3381d179068690f49e0fa1e28a36a1382
MD5 af6d1a01bb94a3d47731766bf2aba7e8
SHA1 f8dd8c94ff486124f09a17fb6292a34a0159b8b6
SHA512 dc63a023f49004bfd2d0a042b14a14f3258071616ac353b9c757203f14ea66e0e469b0fa9989fb28d0208f12e4a2b94cf891867f966635e59da96b047a17062a
MD5 SHA1 SHA512

Submit Download

nuowf.exe

Path C:\Users\Admin\AppData\Local\Temp\nuowf.exe
Size 487KB
SHA256 f3c96d3d17eaa4358c938a0b8f1ec8ab2ec67a661eaae7df172875cdf45738c3
MD5 78d72bb47733ed0f75c69296aa4162e7
SHA1 c74b730f74909b47488f5f8ec76a957b0ae3b4bb
SHA512 df0b17297d190c6b4171a4f5440603d5a3aa145edac227ac0452b3779b14b7bcdb84f78744b7cc7a7ebd590b97b7781a5890fe52bc15a18769faca13a418b696
SSDEEP 12288:Vpbvglu0agWSFnxAEwKyLH8l+O9H6s2si2XfxKTbek:VpbXi5xzFUBaazsiofx85
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3592-12-0x0000000000710000-0x0000000000795000-memory.dmp

Download

memory/3592-25-0x0000000000710000-0x0000000000795000-memory.dmp

Download

memory/4260-14-0x00000000006F0000-0x0000000000775000-memory.dmp

Download

memory/4260-0-0x00000000006F0000-0x0000000000775000-memory.dmp

Download

memory/4412-26-0x0000000000BE0000-0x0000000000BE2000-memory.dmp

Download

memory/4412-27-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download

memory/4412-29-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download

memory/4412-30-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download

memory/4412-31-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download

memory/4412-32-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download

memory/4412-33-0x0000000000C10000-0x0000000000CC4000-memory.dmp

Download