urelas | afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe
Size 442KB
Sample240327-3bx2ysdb98
SHA256 afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28
MD5 01e18811ed1a7208b10b4c0755e4f2ce
SHA1 f914755dd977b12dd1b38711cf09f0ec293b0247
SHA512 bcca5e0feed2148198fff6ce5f50e42d17fff526dd728c8a8bb82327d073df5e8af0c894873ecf7466bd69387bee806717276c18de820fe8deeccb4a17b7b6e6
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdK2X:vMpASIcWYx2U6hAJQnXE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	duqew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	nuinyp.exe

Executes dropped EXE 3 IoCs

pid	Process
3636	duqew.exe
1360	nuinyp.exe
3136	nilus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe
3136	nilus.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3636	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	86
PID 2120 wrote to memory of 3636	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	86
PID 2120 wrote to memory of 3636	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	86
PID 2120 wrote to memory of 464	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	87
PID 2120 wrote to memory of 464	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	87
PID 2120 wrote to memory of 464	2120	afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe	87
PID 3636 wrote to memory of 1360	3636	duqew.exe	90
PID 3636 wrote to memory of 1360	3636	duqew.exe	90
PID 3636 wrote to memory of 1360	3636	duqew.exe	90
PID 1360 wrote to memory of 3136	1360	nuinyp.exe	100
PID 1360 wrote to memory of 3136	1360	nuinyp.exe	100
PID 1360 wrote to memory of 3136	1360	nuinyp.exe	100
PID 1360 wrote to memory of 2792	1360	nuinyp.exe	101
PID 1360 wrote to memory of 2792	1360	nuinyp.exe	101
PID 1360 wrote to memory of 2792	1360	nuinyp.exe	101

C:\Users\Admin\AppData\Local\Temp\afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe
"C:\Users\Admin\AppData\Local\Temp\afdf031489656e1128bbcbf29042bc3a30c89f928f0662a4758d4a54ab2ade28.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\duqew.exe
  "C:\Users\Admin\AppData\Local\Temp\duqew.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Users\Admin\AppData\Local\Temp\nuinyp.exe
    "C:\Users\Admin\AppData\Local\Temp\nuinyp.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\nilus.exe
      "C:\Users\Admin\AppData\Local\Temp\nilus.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1edd08360e0637a6caa296c21b02a2a17ac4c34396699ad3430385fe1b770fa4
MD5 d59f3603222ec97e744f1afee14fa2e5
SHA1 ac625189391d2d95ce92307fbfde7e20ad798aa2
SHA512 9afaf2f8ac3a18eec736c13167499be82ebafccb2ba3ec9e3d81469d43c2b6d42e2e2f70aaf861b403d9bad03d86aacfa241c6074fadace191eb351c075e18a5
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 5fd916b4f2f1a71c054715aad81aca9bfc4079ee120b1f43c9e2ac1c13f46540
MD5 24be3269b2145333de15103241d210eb
SHA1 edd7ebc5635561749514f3d8f7f34f83b81fa5d8
SHA512 71514b34efe6e00e14705b03a10139945f96b842ab5e1744cb7a78e11898dd6a965cdedf10ffa4f0a9af8d3b9cfa57d4906f69b909915f601ad12866a6330079
MD5 SHA1 SHA512

Submit Download

duqew.exe

Path C:\Users\Admin\AppData\Local\Temp\duqew.exe
Size 442KB
SHA256 3d8bfe561b2fd879036da46ad66b901fe5adafc45c1178362ed86cf4bb30aee7
MD5 4686dd0e19fb8ea692b4821b14d8aa4e
SHA1 e96a4b310b446e2f75f7e4c60c96b3a429b3c654
SHA512 b7704bf622c384217491f46c83cbe96cf1bf60bb8245360b77bb3f01824f975e2f5c9dd4e42229844e51a6e35c51a34797d3bdd9ee606cf539d5421112609d00
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdK2Q:vMpASIcWYx2U6hAJQnXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 25cd01a8758afdd991924c04ee431f3e474bb6669981213e4f27677ba72e84b3
MD5 ab22d4c324d7e35f2af05d1ec806d1f6
SHA1 606e470c108d56913699e21f184e9c90d1c88302
SHA512 ff5d1ad5c103d06f888556ddb1c72e76e67e8c845083cb2af1b8b9755b6d4b56a526890cc52129ff58610938b3c4f715ae3b02f6c56246df4e2cbff544208ed9
MD5 SHA1 SHA512

Submit Download

nilus.exe

Path C:\Users\Admin\AppData\Local\Temp\nilus.exe
Size 223KB
SHA256 b292f2638c9f05ed5f59962b6f58a3ac145085000f71a6575b6dbaaea908df43
MD5 ed485e9b89e0ad3497977ac26227a1a3
SHA1 fb1a1c73898dd70dbd4a2f51cfa7120e2dc6385f
SHA512 d6d7134c7084dc8449c4aee1b3ae24409f61a2954e89bf4d17b331186b518832a22899e274d5cd2348c0502337f6ddeb443e382ff4079a60967b263313d5f0db
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3d:unFhSIkAyDgjtS/FZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nuinyp.exe

Path C:\Users\Admin\AppData\Local\Temp\nuinyp.exe
Size 443KB
SHA256 d47d4fe87543d5c5c6bd46239f878f68258b4bd30a1824a0cc7bb82f9d4f7ef6
MD5 a7ae1d2734a6875af711aa208132b097
SHA1 632b85c95e79ca407acfcbfe8fdc3a832261c35a
SHA512 0f6ffea9d69287d083ad3e5123de5e2cfe6ad520858d5071b81059527447accfa41ad2880daa6129906a8138030476b7eb559829f2a9da84d205a23b6d31242c
SSDEEP 6144:vEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdK2g:vMpASIcWYx2U6hAJQnXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1360-39-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1360-25-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2120-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2120-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3136-43-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3136-37-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3136-38-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/3136-42-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3136-44-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3136-45-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3136-46-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3636-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download