urelas | 3465a6f61f1327ffdf1264cc9616040f308f466c2ea8e4d7fa96a954649f0dfc

General

Target

34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe
Size

290KB
MD5

34373a2cd74d55362c44e5bcd569ba00
SHA1

b704e9bdb73bae4d9bca9d4c3b074070e525f07a
SHA256

3465a6f61f1327ffdf1264cc9616040f308f466c2ea8e4d7fa96a954649f0dfc
SHA512

29f7b7a24a9c4dcf315c761d70da5f39488326cc9712195d5772b94f77db376372e350f67e075a7a3abc11beb21ecb64ea10ffb988f3f203ad3b5405b9ae87d8
SSDEEP

6144:96xwSR5NtUIJEWyXuew+q1l0d2Js6H5/TZkKr+:9A3NtUISdPw+Elq2Jsm2j

Score

10^/10

urelas aspackv2 trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\kyvoh.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exeewvuo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ewvuo.exe

Executes dropped EXE 2 IoCs

Processes:

ewvuo.exekyvoh.exe

pid process

2248 ewvuo.exe
956 kyvoh.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2248	ewvuo.exe
956	kyvoh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

kyvoh.exe

pid	process
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe
956	kyvoh.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exeewvuo.exe

description	pid	process	target process
PID 4752 wrote to memory of 2248	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	ewvuo.exe
PID 4752 wrote to memory of 2248	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	ewvuo.exe
PID 4752 wrote to memory of 2248	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	ewvuo.exe
PID 4752 wrote to memory of 732	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	cmd.exe
PID 4752 wrote to memory of 732	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	cmd.exe
PID 4752 wrote to memory of 732	4752	34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe	cmd.exe
PID 2248 wrote to memory of 956	2248	ewvuo.exe	kyvoh.exe
PID 2248 wrote to memory of 956	2248	ewvuo.exe	kyvoh.exe
PID 2248 wrote to memory of 956	2248	ewvuo.exe	kyvoh.exe

C:\Users\Admin\AppData\Local\Temp\34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34373a2cd74d55362c44e5bcd569ba00_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\ewvuo.exe
  "C:\Users\Admin\AppData\Local\Temp\ewvuo.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Users\Admin\AppData\Local\Temp\kyvoh.exe
    "C:\Users\Admin\AppData\Local\Temp\kyvoh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
306B

MD5
56c51fa9ecef8e5d1c21f02c7d28aa13

SHA1
88f8148b0e53a827053580a1353abd5f459ec1bd

SHA256
99fd1205ca5ad241687209bc04a06c39a9eab0f0fe8d62af36b31291ee6aa069

SHA512
5ace88a878921c44c69a8ffdcd54cec9613a2e04facf0e84d753826ec1f11b149d6c89c57991bb5ec130c0c0556cf69959f0ea2f51f89834753d857c407c3a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewvuo.exe

Filesize
290KB

MD5
5fd742d218c58ef61de5e6c10e932851

SHA1
5df7bfcf28a04f6f0a8f7683036a263075b8b8be

SHA256
076a9dfd690c58e6eb250e59493b1209dd12d46ba37483f8c40a9e2af3ee92c0

SHA512
96448b008fff2ba18ae135f8b1ff9e06a9289b133987a34c4cb80a95441da3791c9643266c602e1eb1edcd22b11c658419b1941d09c36fe17e1adc227f622c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
ab7612550ddae6991eac48b27bd78e77

SHA1
c9921e8dbd04dffc454f472100e660f3c8e906b3

SHA256
d93793f9956bc7bb8c10b2f811a8f5f78acd1afd0d39dae84b5b43ee07106c43

SHA512
631c4fb0013718718e22652b30f80f1d7d015ac3547734d30568698bfb5ee6cb99d18fc504a7984c62451534f82b78d0a933453325c58b17e309f751f2cb6f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyvoh.exe

Filesize
216KB

MD5
fabc59a0f032409d9869569d263803b4

SHA1
0bdcc2d3c0e6aa4fd98a54e87d78d58bdf77a166

SHA256
3868aaa004a38a6c1ee051b0e741cca1759973599bb62f5318024337985d74e1

SHA512
f5beb2fa06bda0e726416ce19aa429f72a952fabb6877f94354d5b8e7b64cf8da1c49a6d68780ac9b5377d387c647c6e9118571dfdff4ee426e82a8298abd53d

Download Submit
memory/956-48-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-46-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-47-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-39-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-45-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-38-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-49-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-41-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/956-40-0x0000000000E30000-0x0000000000ED2000-memory.dmp

Filesize
648KB

Download
memory/2248-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2248-22-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/2248-43-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2248-20-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2248-14-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/4752-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4752-17-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4752-1-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads