urelas | 604e4873305c29b900ad2f6307726dde665a69c54bcb00df0c4b82403f098205

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe
Size

430KB
MD5

db2dae2c9dcb4e0ca11c4954d2ac6210
SHA1

0af265bc32c5e04bf672c5214b7336a45e5f610d
SHA256

604e4873305c29b900ad2f6307726dde665a69c54bcb00df0c4b82403f098205
SHA512

866e2ff535549ebd89df3812eca77a6d418f6e45ab0ab2c7c34f72e6cc5c7941929858d9099cd212bcae625a97414d62b5deda817d81a46a00970ac90d35754d
SSDEEP

6144:BKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fkKmC:4ANxU3VH1t19MsAlpXw

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	vanam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2004	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	94
PID 4436 wrote to memory of 2004	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	94
PID 4436 wrote to memory of 2004	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	94
PID 4436 wrote to memory of 3308	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	95
PID 4436 wrote to memory of 3308	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	95
PID 4436 wrote to memory of 3308	4436	db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\db2dae2c9dcb4e0ca11c4954d2ac6210_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\vanam.exe
  "C:\Users\Admin\AppData\Local\Temp\vanam.exe"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1712 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
306B

MD5
767f7cfaad35e21a8867d8a753eea7d3

SHA1
b62fe2147de17fca026d5a283ec3e13b6a8669d8

SHA256
a10dd3841802d279970e590b17da1e1078e147fec3633cfdf45f4aca122bb9d5

SHA512
f59804b3c4d0865d7cd4eae59cda35d2b1e6fdab0d6f70e5cc07dee695ae080a17e4b92ce9aa5e03987f1de68ff47e362cce0f2a6f52f62124a5dbd9a721e689

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
404bce4fbcc16ca8eff12dcbdc705641

SHA1
32a1e77879a7a2698c8bbe39971fe6b4f65f9b01

SHA256
e4b06d5e90b69944878f0edfc4470ce247645c1f6f84b411b9163742f993ac1c

SHA512
f864370cfbcd5368c64d00a503bf9b27e90c2808e4d4ac8bd328e1c2a9fb51a6712fef9d891242aec81db0ff67df6017bfbf0ce0c081b46b55e0ebf65565b5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vanam.exe

Filesize
430KB

MD5
a15331e77ed06d6e2a9c2a893d60687b

SHA1
bf13004fd1d02cab5a1963a46deff75fb0de076f

SHA256
5f4c57636b1a6171984304a49312e7a5d97df691e0f7087c5b084aceea0693c0

SHA512
40d9395c111bef7edb467b97eae08e7b40cbbbefa5d6b2f4cd6c29f6908b9d1bb9136b4be0cdadae41f1eadfc93c9c2ab504490c81aafb08a684da93632fc8c1

Download Submit
memory/4436-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4436-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download