urelas | d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe
Size 418KB
Sample240810-dgbcpsxala
SHA256 d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a
MD5 298a3304743209f3c6ea4dc6549543ab
SHA1 90255927b567cf07d0e3e5d00763a554eed29fc2
SHA512 7f010e0fb5d30eb524600017907e9c3942f2b649a21050868f7b38b0217388347d5e9f77b682cc187b7683e32f288f1d54a744a8889769d262fc81477eb9804c
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iC:yIfBoDWoyFboU6hAJQnrMX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	fyycji.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	toavd.exe

Executes dropped EXE 3 IoCs

pid	Process
1844	toavd.exe
3048	fyycji.exe
4380	kyijz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyycji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyijz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toavd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe
4380	kyijz.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1844	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	84
PID 376 wrote to memory of 1844	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	84
PID 376 wrote to memory of 1844	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	84
PID 376 wrote to memory of 1452	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	85
PID 376 wrote to memory of 1452	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	85
PID 376 wrote to memory of 1452	376	d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe	85
PID 1844 wrote to memory of 3048	1844	toavd.exe	87
PID 1844 wrote to memory of 3048	1844	toavd.exe	87
PID 1844 wrote to memory of 3048	1844	toavd.exe	87
PID 3048 wrote to memory of 4380	3048	fyycji.exe	102
PID 3048 wrote to memory of 4380	3048	fyycji.exe	102
PID 3048 wrote to memory of 4380	3048	fyycji.exe	102
PID 3048 wrote to memory of 2940	3048	fyycji.exe	103
PID 3048 wrote to memory of 2940	3048	fyycji.exe	103
PID 3048 wrote to memory of 2940	3048	fyycji.exe	103

C:\Users\Admin\AppData\Local\Temp\d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe
"C:\Users\Admin\AppData\Local\Temp\d036998aa2c1d2a6d6a7347de170a705559fa44bb01d0421a2b820a3e369b58a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\Temp\toavd.exe
  "C:\Users\Admin\AppData\Local\Temp\toavd.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\fyycji.exe
    "C:\Users\Admin\AppData\Local\Temp\fyycji.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\kyijz.exe
      "C:\Users\Admin\AppData\Local\Temp\kyijz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 9c43fb34e4d85ae52460bf478cac3717f26b53fedb99b39ccab9f6429a7cf13b
MD5 569e0cc6090f980026d6dad7d1a3fbbd
SHA1 99dc5a172b0a1b69cc7ff7351337aecf53e08db8
SHA512 e7817d61415f1e7c0a19d7cf4b1d99411be97918933c54d62e097f65cbac7b7ad452aa54df267bafc06c35980f9e64349840c94439b77e900e93d9e025926aec
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 eab26891cee40248dbde3f4dd55ae27635b4924e126a9b5b1375a51fbfc7c272
MD5 1114185ce313273f782c3074e78652e6
SHA1 7c543576139eafe2cc05ceb158cec19a77e1e0ea
SHA512 a7968ff964b79f2e54f9a94f7d283871ca894bf859c63fb3a0cd563442316b352c8e250624f9757e5dc1475ee2a4cc9b0b7b36e5c31989c11aea9afff59e1bc9
MD5 SHA1 SHA512

Submit Download

fyycji.exe

Path C:\Users\Admin\AppData\Local\Temp\fyycji.exe
Size 419KB
SHA256 cec60a086ba9d7dee89ba61e05d5bf50c14e9ee7073c40115f69499570d8f80a
MD5 e65e1b1a2b9541922d57efad159803a2
SHA1 f8bd5a2be928337b8cdf1d36a41b4135ca2b61cc
SHA512 8c29e188c86fe991af337cb8a2c0d23c43af8ec48fcd9f44eadfe53fd9702a80f7981324e626d911b45cd8c5c67aec5e8b3c58765db512252f823a09bd99d944
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iI:yIfBoDWoyFboU6hAJQnrMH
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 115b7c4dea73837972ad4b532cc218b319fa14bd88e11a58fe5b48e7cfc1867c
MD5 8f20adcd088252f8a4601fc5235fcbb3
SHA1 f9b83f6380c19c038beba1e380f88e8f8e611bae
SHA512 7e1824a8eafcba0b03d00ce59aa3a75793ed27caa425eb947b25bb0f02e864dd9babbe1799192ec01ff20dca025074970b711f3f8f71cd62b3c72230d809a952
MD5 SHA1 SHA512

Submit Download

kyijz.exe

Path C:\Users\Admin\AppData\Local\Temp\kyijz.exe
Size 223KB
SHA256 d969e881cd1aa6f2001e3170a9f4879bdecddbf052fbd1377a00bade3a6968b1
MD5 f1442560e8b4a78ebaed61114ecbd928
SHA1 68a0d9bb0324160f5de9fb674f5b574e707455fa
SHA512 529546a9db5b4e715c46c0b683e83a14866336c73a0bc41d0eb3c1da39ba3b64ebd3c95b392d7cbde9be6c88f52e1568277928c18f0c188fd7ac77950f2b99af
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3/:unFhSIkAyDgjtS/FZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

toavd.exe

Path C:\Users\Admin\AppData\Local\Temp\toavd.exe
Size 418KB
SHA256 b7647415366e4bdc349e2e16c60f45da245a2da856e6fe912d5d2fd14fe94381
MD5 d1e2a4bde456d742135bfb818d2bc231
SHA1 de11ab3f88274d0a8d32a293809e24f2685cb99e
SHA512 c5b71aa917644bec1ea97a6d93b4cd86d8103d4c9ca145ae6ea136eaa07979cdfda9f295eee01c43bf0e72365d32b0cbbdbfe475235b2567585c93d8526f123b
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iC:yIfBoDWoyFboU6hAJQnrMh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-15-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/376-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1844-11-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1844-26-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3048-39-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3048-25-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4380-37-0x0000000000010000-0x00000000000B0000-memory.dmp

Download

memory/4380-42-0x0000000000010000-0x00000000000B0000-memory.dmp

Download

memory/4380-43-0x0000000000010000-0x00000000000B0000-memory.dmp

Download

memory/4380-44-0x0000000000010000-0x00000000000B0000-memory.dmp

Download

memory/4380-45-0x0000000000010000-0x00000000000B0000-memory.dmp

Download

memory/4380-46-0x0000000000010000-0x00000000000B0000-memory.dmp

Download