urelas | 5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e

Analysis

max time kernel
146s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
Size 6.5MB
Sample240807-1lqphsyamd
SHA256 5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e
MD5 a0a8f5800b7e7d908d31f512b7921dec
SHA1 3316cf21b5d6edd68daba5dc4ecdfaacb9278c17
SHA512 f3d70a94887b2b69d1a76641e621cb857be7cca82fa6fdac7e53ed75d7de776a4f2ad4bf6741134474a00333387df6fc1eac27a402f5f1dce279cb47ad36cdb3
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSt:i0LrA2kHKQHNk3og9unipQyOaOt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	pyeqs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	kyqoky.exe

Executes dropped EXE 3 IoCs

pid	Process
4784	pyeqs.exe
4748	kyqoky.exe
4544	boufe.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c0000000234bd-63.dat	upx
behavioral2/memory/4544-69-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/4544-74-0x0000000000400000-0x0000000000599000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyeqs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyqoky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boufe.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
4784	pyeqs.exe
4784	pyeqs.exe
4748	kyqoky.exe
4748	kyqoky.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe
4544	boufe.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4784	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	86
PID 3988 wrote to memory of 4784	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	86
PID 3988 wrote to memory of 4784	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	86
PID 3988 wrote to memory of 4960	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	87
PID 3988 wrote to memory of 4960	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	87
PID 3988 wrote to memory of 4960	3988	5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe	87
PID 4784 wrote to memory of 4748	4784	pyeqs.exe	89
PID 4784 wrote to memory of 4748	4784	pyeqs.exe	89
PID 4784 wrote to memory of 4748	4784	pyeqs.exe	89
PID 4748 wrote to memory of 4544	4748	kyqoky.exe	94
PID 4748 wrote to memory of 4544	4748	kyqoky.exe	94
PID 4748 wrote to memory of 4544	4748	kyqoky.exe	94
PID 4748 wrote to memory of 3088	4748	kyqoky.exe	95
PID 4748 wrote to memory of 3088	4748	kyqoky.exe	95
PID 4748 wrote to memory of 3088	4748	kyqoky.exe	95

C:\Users\Admin\AppData\Local\Temp\5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe
"C:\Users\Admin\AppData\Local\Temp\5093d8c54f936d750247861626900165ed1a1a0b4031b2ed178ccf2125ae5e8e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\pyeqs.exe
  "C:\Users\Admin\AppData\Local\Temp\pyeqs.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\kyqoky.exe
    "C:\Users\Admin\AppData\Local\Temp\kyqoky.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\boufe.exe
      "C:\Users\Admin\AppData\Local\Temp\boufe.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 14617c5d5c0b16e1d8c845cbed998de813b2524a98d56dd6efadc7155fb54f56
MD5 a372b778baecac45e4ad237d72914b23
SHA1 f865dd3a4c1ac1458e7a1ac4c2f125382c35face
SHA512 48749be43a59dd9ed8cf5472c891f56037e30c3ba2383b789fc3bdcf79ae0a6cf21a728b0eea0c54af16a66549adc7d2b98ede89bcb11d74e1c9bb7d9b90e408
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 f583f215cc4b75178c1b05bed17694223aaa494b6298dc48d5971b2bcf5194ce
MD5 fbda5501e0cc5d81f18db3e932f5f92d
SHA1 561a1409b02236a4a3b8fce97cc4269bf722b5d9
SHA512 932edd3e01e7b9576f1e3a1e94988cec2cef0775938d4a6ba02dbb2f48dd1d869225e5a8236c5ba4896ffd03db1cfcba7d26ae95824ae41aac1bc34f5a81019b
MD5 SHA1 SHA512

Submit Download

boufe.exe

Path C:\Users\Admin\AppData\Local\Temp\boufe.exe
Size 459KB
SHA256 b4a898d61e6ddbb61d73a348a44c3fda0ecefae39fabaffecbf54853a98e7339
MD5 78a0b650b0a7c464b000cd64f8214dd9
SHA1 823b930a88dee63d4d78d45592ab997a0e352be1
SHA512 b10c38c2414a028444eba0c8c6460ae52b770a40abe5e02cc961b3a68cf858a6f19c609556d1c5a21c14b61f64e059ba01f70d24465ee2581d5fa19191cc9cf2
SSDEEP 12288:fXb1TjQ+p3rbNuqsDBFBygivAIKMV4qljNk2oSZ:fXbrp3rbER9rNpIKW4qJW4
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1fae80014ae2e4b6205a9a0abd7c379ac0813daff49b23dd392454146c172d82
MD5 8d0ae61ebb0a3b537e5a69739fbbcfed
SHA1 be360f991ba1d88ea284ece09dcdbe41ee1db6c7
SHA512 884ae10250144b037ef76d5afb0692ad53311aceb6fb2324bd40d156b78d890de2fc9e21e34b57369f26b79f56e5a53d11d4eba52973bae3c7cde41f34a2554e
MD5 SHA1 SHA512

Submit Download

pyeqs.exe

Path C:\Users\Admin\AppData\Local\Temp\pyeqs.exe
Size 6.5MB
SHA256 8c4dc416c07e0fad1d062cd8bfe7e1f7da445d47e95c105912ae28ae70d40399
MD5 c4819d80f3e956bf84b346a540ff63ef
SHA1 0a2255c7b1da0f4c1ea82c260164f1813d87fa04
SHA512 76e1b0cc362a5424f74dcae024fb135b92a625ce21f46a368bd5184f9e98540c60f567bf379e736461fca89c8dea8a1035ca6b0abc891885b1125308acb4f61f
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSd:i0LrA2kHKQHNk3og9unipQyOaOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3988-8-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/3988-25-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3988-5-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/3988-4-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/3988-13-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3988-7-0x00000000010B0000-0x00000000010B1000-memory.dmp

Download

memory/3988-2-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/3988-6-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/3988-26-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/3988-0-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3988-1-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/3988-10-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3988-3-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/4544-69-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/4544-74-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/4748-56-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4748-53-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/4748-71-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4748-49-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/4748-50-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/4748-51-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/4748-52-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/4748-55-0x0000000002A80000-0x0000000002A81000-memory.dmp

Download

memory/4748-54-0x00000000011C0000-0x00000000011C1000-memory.dmp

Download

memory/4784-48-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4784-33-0x0000000002B60000-0x0000000002B61000-memory.dmp

Download

memory/4784-32-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/4784-28-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4784-29-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/4784-30-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/4784-34-0x0000000002B70000-0x0000000002B71000-memory.dmp

Download

memory/4784-35-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4784-31-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Download

memory/4784-39-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4784-38-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4784-24-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download