urelas | a173df64c5cac8fade7a480d53d0c55af138f41ae25a11a0f1653984eb3cf019

General

Target

87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe
Size

399KB
MD5

87df4aa743aa38020380f61c9cee9100
SHA1

891fa34174bd7386a255659d2e1a43dc133c65fb
SHA256

a173df64c5cac8fade7a480d53d0c55af138f41ae25a11a0f1653984eb3cf019
SHA512

54b59e529a7ac51c3819cb5f437edcb869bea35c796f7fbbdbce91238c5a83f997542845a4fd12dd848c60b43fb04df12f78bf9670500b6bcc18eeb1d7c30a3d
SSDEEP

6144:1sa1jZVgy03se7k5kBTTg7YMz6j8GuHEqqtKKUrBwj3bT3RzS:rtVgyuse2kBXg7Cj81cKK7jfRS

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.165

218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exeypnek.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ypnek.exe

Executes dropped EXE 2 IoCs

Processes:

ypnek.exeiszux.exe

pid process

5072 ypnek.exe
3036 iszux.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5072	ypnek.exe
3036	iszux.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

iszux.exe

pid	process
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe
3036	iszux.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exeypnek.exe

description	pid	process	target process
PID 3280 wrote to memory of 5072	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	ypnek.exe
PID 3280 wrote to memory of 5072	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	ypnek.exe
PID 3280 wrote to memory of 5072	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	ypnek.exe
PID 3280 wrote to memory of 3568	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	cmd.exe
PID 3280 wrote to memory of 3568	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	cmd.exe
PID 3280 wrote to memory of 3568	3280	87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe	cmd.exe
PID 5072 wrote to memory of 3036	5072	ypnek.exe	iszux.exe
PID 5072 wrote to memory of 3036	5072	ypnek.exe	iszux.exe
PID 5072 wrote to memory of 3036	5072	ypnek.exe	iszux.exe

C:\Users\Admin\AppData\Local\Temp\87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\87df4aa743aa38020380f61c9cee9100_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3280

C:\Users\Admin\AppData\Local\Temp\ypnek.exe
"C:\Users\Admin\AppData\Local\Temp\ypnek.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\iszux.exe
"C:\Users\Admin\AppData\Local\Temp\iszux.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
2⤵
PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Filesize
306B

MD5
2583926963fac30b7d5af56123f46fa5

SHA1
fb0328e4027c2bdf7464bf0a339016b64cc212b5

SHA256
d78b8a268eb39c1875165e8a448a1b47c48aa446d3475218086167d440dcc198

SHA512
75f6e4c90a4f679f8d0c8fba0bcf58b5b3b29abbc204f9e8045c12169bc061ecfc3dc33890d07844284f3f9bef111b1f903d9ad0d19f5fcf5004ffae88d415c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
c0fcc6625627dab9e2475084c0ccb0b1

SHA1
091b4a30001194609ef160c8c24db3b40b9dbd21

SHA256
0bd9e4b634d12457c54349697322535186bd149d019246e2dd36a99a7cac17cc

SHA512
50d1fec93e7988462a71e588a975002020732a5b83a916d86d725ec5ff43fde9f45f2b0d25e2199f96cedd7645ae67e5c7335a23600fcc845de0ebc48853a4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\iszux.exe
Filesize
206KB

MD5
f6b11ffc62330659c5f07af4b8e67438

SHA1
3afd71d8410410c22eafad8008341425edd3d39c

SHA256
5a78064736a0f0e18cf30dbc695ace1a63518d000e173783b768d81f77bf10b7

SHA512
ca9e9ed6be2c7ddb9a904b1087e3668f0b1dc4014037ea787b890ccf9123e4742c67ac83c074a3d2c1a311e57c78eebda48ddd7a43887abb423b7b3d656433e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ypnek.exe
Filesize
399KB

MD5
ae3b768e51fb7b2a69a70dc847bd3309

SHA1
098d7391c377f570f30de0d4833cb53f394b264d

SHA256
b11453e5374ceed7bcb420134e599e5cfdbc66c1c6a36c885d458ad89d509cf5

SHA512
e91746570ed1a13d45cc5f8668680d986c489fdd3f6301b8cd5cd14799ccda66de13c9a004209655616aa7b5da2b872a14b9b51f2b1a32db5d550439f46dfc9d

Download Submit
memory/3036-27-0x000000000065A000-0x000000000065B000-memory.dmp

Filesize
4KB

Download
memory/3036-26-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3036-29-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3036-30-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3036-31-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3036-32-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3036-33-0x00000000005C0000-0x000000000065B000-memory.dmp

Filesize
620KB

Download
memory/3280-14-0x0000000000840000-0x00000000008A8000-memory.dmp

Filesize
416KB

Download
memory/3280-0-0x0000000000840000-0x00000000008A8000-memory.dmp

Filesize
416KB

Download
memory/5072-25-0x0000000000430000-0x0000000000498000-memory.dmp

Filesize
416KB

Download
memory/5072-12-0x0000000000430000-0x0000000000498000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads