urelas | 5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e

Analysis

max time kernel
147s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
Size 6.5MB
Sample240807-1lqphsyamd
SHA256 5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e
MD5 a0a8f5800b7e7d908d31f512b7921dec
SHA1 3316cf21b5d6edd68daba5dc4ecdfaacb9278c17
SHA512 f3d70a94887b2b69d1a76641e621cb857be7cca82fa6fdac7e53ed75d7de776a4f2ad4bf6741134474a00333387df6fc1eac27a402f5f1dce279cb47ad36cdb3
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSt:i0LrA2kHKQHNk3og9unipQyOaOt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
3016	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1992	xuybx.exe
2144	mubedi.exe
2492	voysh.exe

Loads dropped DLL 5 IoCs

pid	Process
1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
1992	xuybx.exe
1992	xuybx.exe
2144	mubedi.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015fa3-156.dat	upx
behavioral1/memory/2492-169-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral1/memory/2492-175-0x0000000000400000-0x0000000000599000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuybx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mubedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voysh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
1992	xuybx.exe
2144	mubedi.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe
2492	voysh.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1992	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	30
PID 1996 wrote to memory of 1992	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	30
PID 1996 wrote to memory of 1992	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	30
PID 1996 wrote to memory of 1992	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	30
PID 1996 wrote to memory of 3016	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	31
PID 1996 wrote to memory of 3016	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	31
PID 1996 wrote to memory of 3016	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	31
PID 1996 wrote to memory of 3016	1996	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	31
PID 1992 wrote to memory of 2144	1992	xuybx.exe	34
PID 1992 wrote to memory of 2144	1992	xuybx.exe	34
PID 1992 wrote to memory of 2144	1992	xuybx.exe	34
PID 1992 wrote to memory of 2144	1992	xuybx.exe	34
PID 2144 wrote to memory of 2492	2144	mubedi.exe	35
PID 2144 wrote to memory of 2492	2144	mubedi.exe	35
PID 2144 wrote to memory of 2492	2144	mubedi.exe	35
PID 2144 wrote to memory of 2492	2144	mubedi.exe	35
PID 2144 wrote to memory of 2576	2144	mubedi.exe	36
PID 2144 wrote to memory of 2576	2144	mubedi.exe	36
PID 2144 wrote to memory of 2576	2144	mubedi.exe	36
PID 2144 wrote to memory of 2576	2144	mubedi.exe	36

C:\Users\Admin\AppData\Local\Temp\5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
"C:\Users\Admin\AppData\Local\Temp\5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\xuybx.exe
  "C:\Users\Admin\AppData\Local\Temp\xuybx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\mubedi.exe
    "C:\Users\Admin\AppData\Local\Temp\mubedi.exe" OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\voysh.exe
      "C:\Users\Admin\AppData\Local\Temp\voysh.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 14617c5d5c0b16e1d8c845cbed998de813b2524a98d56dd6efadc7155fb54f56
MD5 a372b778baecac45e4ad237d72914b23
SHA1 f865dd3a4c1ac1458e7a1ac4c2f125382c35face
SHA512 48749be43a59dd9ed8cf5472c891f56037e30c3ba2383b789fc3bdcf79ae0a6cf21a728b0eea0c54af16a66549adc7d2b98ede89bcb11d74e1c9bb7d9b90e408
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 876e01574c57b8a58573a09a86290bcc315933abbcfaa15f497603cc7684acd2
MD5 ae79b104461bbc087a9a54ea31fe8dc8
SHA1 1392ce4588f543fffa0931544ade647a3e876223
SHA512 02ad40260fa87a55dffc8a29bfacd11b9ba45336f8157f1ed0b9b9d2f479f6761eb0cd6e82d22d6b779f37014bb30e42fd5a11345bd358fdbc3613e351ec7370
MD5 SHA1 SHA512

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 eed65654eb4872a16f60eebae4d40daf4a88a7b81b8963bbeb8b094dbd9f15b4
MD5 4d9e93e01065463d6f6159c36ad6cbe2
SHA1 590549488a4e5a3c16dbce84dcc25926486df38e
SHA512 1a502d78d7fb475210d0856140961ed8ed9053fc6af84ed2d2f686cb18836d4393bc9390936f827566c549e45b9b489b964d0d3466649c6c0e20157680d9bb16
MD5 SHA1 SHA512

Submit Download

voysh.exe

Path \Users\Admin\AppData\Local\Temp\voysh.exe
Size 459KB
SHA256 8d991b6751877448a66854c2f37276b236b611d156e37025c262d8aeb9f7b606
MD5 8878641d16e55e942144d9d3af55f69e
SHA1 cd13f24065dd8301612a43b8537471ab128279c7
SHA512 bd584e885fb1deabc27c5f88c670d84d315d05501211d1f85db96c3b0479af4c7eefc9ae8a3636eb95b30f72dd531d4b7b2df72ccbe2ab56feaef931b7d8af2c
SSDEEP 12288:fXb1TjQ+p3rbNuqsDBFBygivAIKMV4qljNk2oSr:fXbrp3rbER9rNpIKW4qJWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xuybx.exe

Path \Users\Admin\AppData\Local\Temp\xuybx.exe
Size 6.5MB
SHA256 2ec794b1309392dc217a575c4409753665e9ae5acbfc3a8d90b6a81559654d06
MD5 bb3bce9f6cd42c6039e5ab6690990fc0
SHA1 90ac41d14ca0e45892dbac6a8932ee5ee132b383
SHA512 d7c641239d8c6a0596e3f98dd9fadc730e36ea2771e238659639318ff4228cca8662fa2fe91e258efac4523633a72a2ffe1f423dc6dc93f394af76a2dfe9c3a2
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSs:i0LrA2kHKQHNk3og9unipQyOaOs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1992-111-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/1992-112-0x0000000004470000-0x0000000004F5C000-memory.dmp

Download

memory/1992-110-0x0000000004470000-0x0000000004F5C000-memory.dmp

Download

memory/1996-23-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/1996-25-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/1996-18-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1996-15-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1996-13-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1996-11-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1996-10-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1996-8-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1996-6-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1996-5-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1996-3-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1996-1-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1996-0-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/1996-50-0x0000000004160000-0x0000000004C4C000-memory.dmp

Download

memory/1996-52-0x0000000004160000-0x0000000004C4C000-memory.dmp

Download

memory/1996-20-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1996-61-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/1996-62-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/1996-28-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/1996-30-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/1996-33-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/1996-35-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/1996-36-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/1996-41-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/1996-37-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/2144-160-0x0000000004770000-0x0000000004909000-memory.dmp

Download

memory/2144-170-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/2144-115-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/2492-169-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/2492-175-0x0000000000400000-0x0000000000599000-memory.dmp

Download