urelas | 6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3

Analysis

max time kernel
148s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
Size 6.5MB
Sample240809-2mc1gssgrl
SHA256 6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3
MD5 23a7b8747c18737e004b3a41c03a78e2
SHA1 b65ff6e25073f536b28460129732452078a13055
SHA512 2edeaf270111fe6f8e9ce2ab98e8af810a649b7af7a7e3dd5d469c664338d29a1f9cfec0199ec17416131e68069ff25e5c6fc6dfa94f6dd2bdd6f43b36d502ee
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVS7:i0LrA2kHKQHNk3og9unipQyOaO7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	toavd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	gomaaf.exe

Executes dropped EXE 3 IoCs

pid	Process
3720	toavd.exe
4576	gomaaf.exe
2892	kyijz.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023493-64.dat	upx
behavioral2/memory/2892-71-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/2892-75-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/2892-77-0x0000000000400000-0x0000000000599000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gomaaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyijz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toavd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
3720	toavd.exe
3720	toavd.exe
4576	gomaaf.exe
4576	gomaaf.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe
2892	kyijz.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3720	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	87
PID 3280 wrote to memory of 3720	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	87
PID 3280 wrote to memory of 3720	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	87
PID 3280 wrote to memory of 2732	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	88
PID 3280 wrote to memory of 2732	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	88
PID 3280 wrote to memory of 2732	3280	6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe	88
PID 3720 wrote to memory of 4576	3720	toavd.exe	90
PID 3720 wrote to memory of 4576	3720	toavd.exe	90
PID 3720 wrote to memory of 4576	3720	toavd.exe	90
PID 4576 wrote to memory of 2892	4576	gomaaf.exe	102
PID 4576 wrote to memory of 2892	4576	gomaaf.exe	102
PID 4576 wrote to memory of 2892	4576	gomaaf.exe	102
PID 4576 wrote to memory of 2712	4576	gomaaf.exe	103
PID 4576 wrote to memory of 2712	4576	gomaaf.exe	103
PID 4576 wrote to memory of 2712	4576	gomaaf.exe	103

C:\Users\Admin\AppData\Local\Temp\6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe
"C:\Users\Admin\AppData\Local\Temp\6ed65dc712475b850329b728fda9bda8aa7e386758c39aa4f30ba0f75ef87dd3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\toavd.exe
  "C:\Users\Admin\AppData\Local\Temp\toavd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\gomaaf.exe
    "C:\Users\Admin\AppData\Local\Temp\gomaaf.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\kyijz.exe
      "C:\Users\Admin\AppData\Local\Temp\kyijz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 605372a1cdb381a3079cc34ebefdef80084816cca402e8244002eb94d8f11db2
MD5 7d88b17633cce15699894f7155869eeb
SHA1 2a17eb5881b1b1a6585e27aa0096c315627633e7
SHA512 4f52b726ecbbf214f3f9bb42782afe3883dae498b22069d5c676bcfe12abd3257609ea253362fce08e48b1a03465ae44435fef983700387795dc68742ed15113
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 a7d7fc1c9393629d90bb2ab25bf087c6fda29dd7c91d27a2fcdfa1d254615b45
MD5 039e362378baa40b93ba578a94a32228
SHA1 1b13a409b3322e3c18e94c24e6114a829166a5e5
SHA512 ba3ac3ed079df544e8edede02fb85569bd0362f8ac005c0a51f54596cb22f2370b2758f977e224d9a46fdc92544a974fd141b7f58ca4f2a93e3af421ebff963b
MD5 SHA1 SHA512

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b67a28eea2cc2426591b1931d3bc3426711e07c3c7b8e75e49c92cc2f19d1284
MD5 a6f8a77aec6df19f966a08a95e231475
SHA1 1630f8f4e10e2bcafff094054f34ed3dda37940a
SHA512 070fd1c423f34a4fa00e1a0813cfc091abc27281e62c413291746adebeee87750ceda5e4213294780aa7bcefd86728c1bbc6f649a89d4d67cc5484dfc750c82e
MD5 SHA1 SHA512

Submit Download

kyijz.exe

Path C:\Users\Admin\AppData\Local\Temp\kyijz.exe
Size 459KB
SHA256 bf8c1e54bed9dc013e71a6b73ffa9f57cff042fbe6045c793b46f21bc166d76f
MD5 14b5979af8e4ce5a7ef0405bc4c1c766
SHA1 f0714ebd45aa35b67e4b9960ea47482a22728348
SHA512 aaa98ff56016b5defc71520d0c737707655c3f625b195a8589d1b99c1981e80829c6ed9b2376d03d1a61136354021abd8a7ca56360936b19a0977b60395caabe
SSDEEP 12288:fXb1TjQ+p3rbNuqsDBFBygivAIKMV4qljNk2oSY:fXbrp3rbER9rNpIKW4qJWL
MD5 SHA1 SHA512 SSDEEP

Submit Download

toavd.exe

Path C:\Users\Admin\AppData\Local\Temp\toavd.exe
Size 6.5MB
SHA256 0d0aab82001a8440c4878484c464c4f46f391b79db11ba4693655c80c6eb2973
MD5 c703358a4ca1ebe362981df777307d63
SHA1 afc518742d48f15332d12925f0ded89e8f22dc80
SHA512 cecae82b226c85af554968c23f40fa42015ae4b3b46ca0bbfb83d91443a178318d8d4e3b1632cf16756d8a732e5180a7e38977421c26928755ef4faa38651597
SSDEEP 98304:Roc5swrA2XGxlHKcjTjNk3o659yrnfKtDrKIAyyks+Ctf8mQZVSd:i0LrA2kHKQHNk3og9unipQyOaOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2892-71-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/2892-75-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/2892-77-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/3280-7-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/3280-4-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/3280-1-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/3280-2-0x0000000000F50000-0x0000000000F51000-memory.dmp

Download

memory/3280-25-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3280-26-0x0000000000526000-0x000000000087A000-memory.dmp

Download

memory/3280-9-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3280-5-0x0000000002C70000-0x0000000002C71000-memory.dmp

Download

memory/3280-13-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3280-8-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/3280-6-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Download

memory/3280-0-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3280-3-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download

memory/3720-32-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/3720-29-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3720-28-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/3720-39-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3720-48-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3720-24-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3720-38-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/3720-34-0x0000000002B60000-0x0000000002B61000-memory.dmp

Download

memory/3720-33-0x0000000002B50000-0x0000000002B51000-memory.dmp

Download

memory/3720-31-0x0000000002A20000-0x0000000002A21000-memory.dmp

Download

memory/3720-30-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/4576-52-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/4576-51-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Download

memory/4576-50-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/4576-53-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4576-54-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/4576-72-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4576-56-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/4576-57-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download

memory/4576-55-0x0000000002A80000-0x0000000002A81000-memory.dmp

Download

memory/4576-49-0x0000000000400000-0x0000000000EEC000-memory.dmp

Download