urelas | 94a01cb2da66ab5010264909270cf4a6da139d5b5978406a950a87bccbef071d

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
822d089e8627808ff9e36719132e9bc0N.exe
Size 483KB
Sample240820-klpjfssenc
SHA256 94a01cb2da66ab5010264909270cf4a6da139d5b5978406a950a87bccbef071d
MD5 822d089e8627808ff9e36719132e9bc0
SHA1 378f996db2657497186b22983c9e2f5ddb41c333
SHA512 54f079dacdb7029404b941a82f8de2418dd7705fcea1e8cb3f23ab3848a7111ca08618b7b03e5c32f12bc7793ec3ee0b7c637eca5ad0bb280f5d587896fdf254
SSDEEP 12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJz:yIp+RFuDyZCnUzJsG1WW8lFz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	822d089e8627808ff9e36719132e9bc0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	kaher.exe

Executes dropped EXE 2 IoCs

pid	Process
1588	kaher.exe
4332	fyqor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyqor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	822d089e8627808ff9e36719132e9bc0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kaher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe
4332	fyqor.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1588	2580	822d089e8627808ff9e36719132e9bc0N.exe	88
PID 2580 wrote to memory of 1588	2580	822d089e8627808ff9e36719132e9bc0N.exe	88
PID 2580 wrote to memory of 1588	2580	822d089e8627808ff9e36719132e9bc0N.exe	88
PID 2580 wrote to memory of 1280	2580	822d089e8627808ff9e36719132e9bc0N.exe	89
PID 2580 wrote to memory of 1280	2580	822d089e8627808ff9e36719132e9bc0N.exe	89
PID 2580 wrote to memory of 1280	2580	822d089e8627808ff9e36719132e9bc0N.exe	89
PID 1588 wrote to memory of 4332	1588	kaher.exe	102
PID 1588 wrote to memory of 4332	1588	kaher.exe	102
PID 1588 wrote to memory of 4332	1588	kaher.exe	102

C:\Users\Admin\AppData\Local\Temp\822d089e8627808ff9e36719132e9bc0N.exe
"C:\Users\Admin\AppData\Local\Temp\822d089e8627808ff9e36719132e9bc0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\kaher.exe
  "C:\Users\Admin\AppData\Local\Temp\kaher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\fyqor.exe
    "C:\Users\Admin\AppData\Local\Temp\fyqor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 b9cb0a773c1581980817641a81b0bf20ecd3dac2e84c4133f6c83bfa6237484a
MD5 0ba368de4eb0cbe90cac7bb3a3a031bc
SHA1 b2c17e5c7013d981cd1d141d038d6ce9665f49a0
SHA512 796e1c7fb7fa3dd67f7b35bced29e6bbdd0202f045eebd262539a53530c70b2201caa86115083fef8dbe375ec5643774442bdcfe5e81f6a3b3e54519cef3fd37
MD5 SHA1 SHA512

Submit Download

fyqor.exe

Path C:\Users\Admin\AppData\Local\Temp\fyqor.exe
Size 190KB
SHA256 e14d3032e1ed4be34a3dfc1ca891bd80282170e4ab1bf159b6e1a32ce39756f1
MD5 4855fe015e1b3fa37c59d5bed9a1f9ee
SHA1 f6fca5e707254b91b0f37571647c07dd2805218f
SHA512 74d2d833ad05491c07690a98c5699242a8b46d1d716d0a88695b31cea5b8ba1269d64dc01f3041bfdff956ba031a6bcab5d39ebf6059b4b0dc0d2831177b0e0b
SSDEEP 3072:HI/hGtm6FIrzyRElnz+aBU7QDJtlqxOaswHGOyxi6RLYPBU85X1ZR9zxc:HIotpOgEdfUsAxRswLy86hx85XHzxc
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a41582d5abd9769bfb84ba9cac826075bd21a92ac8e30d35a81f0534d238f7be
MD5 e452f4687d5cdbece73bfdc4d5111616
SHA1 8c061b9fb735347853c89ccd87e507f2be426d14
SHA512 98b57615bc51cd7daad5e64f071ac1f55346b39d7616e4206fce1d8728abddfc83832fecbb403022ae1b47440d46dd5f3f370c556fe3106982d417002a3e263f
MD5 SHA1 SHA512

Submit Download

kaher.exe

Path C:\Users\Admin\AppData\Local\Temp\kaher.exe
Size 483KB
SHA256 923c9e990621aeebc431b6eeb12d920bcf3bf3bf8c5ef26b28bdd9ea6f607dac
MD5 3a1f57aed4092eb9fb9149c8c1d16dc9
SHA1 4a66c263a70cd907d055a84edfd51b98914c20eb
SHA512 0702c217e5181e0ad6918e79d99cf65413eb9fccdb358fd6e367985ed0be74de4b99fa8e25aa9821df6f61e40939029111f9dd3e7d2276443fb88cc61dd266e9
SSDEEP 12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJ2:yIp+RFuDyZCnUzJsG1WW8lF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-20-0x00000000003A0000-0x0000000000426000-memory.dmp

Download

memory/1588-14-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1588-10-0x00000000003A0000-0x0000000000426000-memory.dmp

Download

memory/1588-39-0x00000000003A0000-0x0000000000426000-memory.dmp

Download

memory/2580-1-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/2580-17-0x0000000000140000-0x00000000001C6000-memory.dmp

Download

memory/2580-0-0x0000000000140000-0x00000000001C6000-memory.dmp

Download

memory/4332-37-0x0000000000B40000-0x0000000000C0B000-memory.dmp

Download

memory/4332-41-0x0000000000B40000-0x0000000000C0B000-memory.dmp

Download

memory/4332-42-0x0000000000B40000-0x0000000000C0B000-memory.dmp

Download

memory/4332-43-0x0000000000B40000-0x0000000000C0B000-memory.dmp

Download