urelas | 93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe
Size 343KB
Sample240327-2bt5macf79
SHA256 93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0
MD5 dee57a28992e70f60acbff5ae08c46ee
SHA1 a40c9db5351c7d644fcc87bab10efb621397365b
SHA512 0228e45212160a98fa80978ba4083ed758f5b24e0f921cf10726012b897e6493c1b90ea303ec42d9da1801ca3e09663e472370955e982dae281ea4130122bca1
SSDEEP 6144:SF/gEKyOAuuHcqXt96bHa+bZu0k6XCCbd2CKcwA2x9G+84AmGSncs:SF/gVyduuHv946gZ6bCbd2qspnA6j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 7 IoCs

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000400000-0x000000000048B000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x00090000000121e6-4.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2316-16-0x0000000000400000-0x000000000048B000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-17-0x0000000000400000-0x000000000048B000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-20-0x0000000000400000-0x000000000048B000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-37-0x0000000000400000-0x000000000048B000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-35-0x00000000026E0000-0x000000000279B000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
2560	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2628	vekuz.exe
2164	jyfub.exe

Loads dropped DLL 2 IoCs

pid	Process
2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe
2628	vekuz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe
2164	jyfub.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2628	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	28
PID 2316 wrote to memory of 2628	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	28
PID 2316 wrote to memory of 2628	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	28
PID 2316 wrote to memory of 2628	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	28
PID 2316 wrote to memory of 2560	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	29
PID 2316 wrote to memory of 2560	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	29
PID 2316 wrote to memory of 2560	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	29
PID 2316 wrote to memory of 2560	2316	93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe	29
PID 2628 wrote to memory of 2164	2628	vekuz.exe	33
PID 2628 wrote to memory of 2164	2628	vekuz.exe	33
PID 2628 wrote to memory of 2164	2628	vekuz.exe	33
PID 2628 wrote to memory of 2164	2628	vekuz.exe	33

C:\Users\Admin\AppData\Local\Temp\93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe
"C:\Users\Admin\AppData\Local\Temp\93a9f8396b430ee8771075e365ae6d2af948a88fceb4ea8ee1f0f75993413ee0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\vekuz.exe
  "C:\Users\Admin\AppData\Local\Temp\vekuz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\jyfub.exe
    "C:\Users\Admin\AppData\Local\Temp\jyfub.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 ee974efef324cc8ddd4c1cb5fb73c70d3eeff32d83a113392b72d169cd3736cb
MD5 9445feb64da727a393dc4b52400f0b20
SHA1 7fd3891427151077443e7d68a886e7717f5df62e
SHA512 0ccebfc35e373045b6201d8f91c268aa1749308c1fa839d4c39da7011cb236f1f9e0c5bd18045c7776b8f70efb5eebc4c3629fb3a218da19b84bcfd29a1c4d76
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 23788f6f3cf383bbc905c02b0dd124f6592608d3d72df83f5d4d3e8af8aa781e
MD5 589d9e5f4101d159016fe2e030631d90
SHA1 52f03888e5f5e890d20db230f3127f3cbf97ebd7
SHA512 ef7363fc733077cb8d87e230873b124aca94d863bbe0398c5d99adffd368c5e344d3a8a5c3be60afd92ebfeb1d3b017fbbb555f57153e1aa6ef5dac9270a13d8
MD5 SHA1 SHA512

Submit Download

jyfub.exe

Path \Users\Admin\AppData\Local\Temp\jyfub.exe
Size 218KB
SHA256 705578c3e2e6a5d4dc444b5af0cad5178aabf34970e533587ddc469804eb58f8
MD5 e5f0ebd72e560f1188fe817af122ea9f
SHA1 279e1bf76c07fe104928786142eba67bb78ab44c
SHA512 66301a6bf6fb6842ae51dcfd00d3216b8df48cc8049d7f9491ea261edfa4ce40db344aeb9e1b0a6bb121b42cb6df6f4d744898e22ef9b6a9a1a536aab2388207
SSDEEP 6144:CuBE7EKk/Re9POivp3WmBMj29nQoNz5iNMUCW:C37P2e9Phv4mBMjqCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vekuz.exe

Path \Users\Admin\AppData\Local\Temp\vekuz.exe
Size 343KB
SHA256 6a57c579085fed04108bb0d4f88f1fffc24197ddeae32153079935c10460cb0e
MD5 68506c81c520055f0a01cb8d24a20191
SHA1 469002107bc730ec6ac923a8b30fa70e091a98a1
SHA512 d76ad1215d38cbad60eeac0afb1173b01c5f3777d0c6683f8a6cc16613246e7ea51965ede1a87f82c30d1a6af53c35b8a8ef941ff31e5ba7be58a23fde6b17d2
SSDEEP 6144:SF/gEKyOAuuHcqXt96bHa+bZu0k6XCCbd2CKcwA2x9G+84AmGSncx:SF/gVyduuHv946gZ6bCbd2qspnA6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2164-40-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2164-38-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2164-36-0x0000000000190000-0x0000000000192000-memory.dmp

Download

memory/2164-41-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2164-42-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2164-43-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2164-44-0x00000000013E0000-0x000000000149B000-memory.dmp

Download

memory/2316-16-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2316-0-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2628-17-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2628-20-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2628-37-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/2628-35-0x00000000026E0000-0x000000000279B000-memory.dmp

Download