urelas | 33fde40e05fa570bb5d53dce070933ca1001e57687fa0327dfe587c97861dd55

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b021eca8188fc387a61f16144201d240N.exe
Size 322KB
Sample240821-e234wszdng
SHA256 33fde40e05fa570bb5d53dce070933ca1001e57687fa0327dfe587c97861dd55
MD5 b021eca8188fc387a61f16144201d240
SHA1 1ba5194fcd8babc2bfadc57dc7bc7bfb7be3dc41
SHA512 5bd71c2db4ddcbd907454d2a88527a6267367b723da8882dc0a17ee9e97adf7479cca40eb9a110c24492ca4a4cf15478b65a05127c0062d399685908e68a95d0
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYd:vHW138/iXWlK885rKlGSekcj66cik
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	b021eca8188fc387a61f16144201d240N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	magoj.exe

Executes dropped EXE 2 IoCs

pid	Process
1564	magoj.exe
3360	pylic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	magoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pylic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b021eca8188fc387a61f16144201d240N.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe
3360	pylic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1564	5004	b021eca8188fc387a61f16144201d240N.exe	87
PID 5004 wrote to memory of 1564	5004	b021eca8188fc387a61f16144201d240N.exe	87
PID 5004 wrote to memory of 1564	5004	b021eca8188fc387a61f16144201d240N.exe	87
PID 5004 wrote to memory of 4580	5004	b021eca8188fc387a61f16144201d240N.exe	88
PID 5004 wrote to memory of 4580	5004	b021eca8188fc387a61f16144201d240N.exe	88
PID 5004 wrote to memory of 4580	5004	b021eca8188fc387a61f16144201d240N.exe	88
PID 1564 wrote to memory of 3360	1564	magoj.exe	101
PID 1564 wrote to memory of 3360	1564	magoj.exe	101
PID 1564 wrote to memory of 3360	1564	magoj.exe	101

C:\Users\Admin\AppData\Local\Temp\b021eca8188fc387a61f16144201d240N.exe
"C:\Users\Admin\AppData\Local\Temp\b021eca8188fc387a61f16144201d240N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\magoj.exe
  "C:\Users\Admin\AppData\Local\Temp\magoj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\pylic.exe
    "C:\Users\Admin\AppData\Local\Temp\pylic.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 b24da4e5a741639df55c2effd7433b6c99f57ccd0304ce4faa39cad9d0c5f749
MD5 384f6745bb464eed0cd2408177454ee2
SHA1 1581248756262b68bc2cb7a032fa7218dda4e1cb
SHA512 82a8d86dd84156e568dc29b7f2ff2ae92cae809fe36efabb63c27eb8c1a523b91fc29ae1c4d4f5e7e47b693313c6814574b374ebbf6214c4feb697ea83dec16c
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 99463050ecc3a48d8ff5cbebd767661a11347667fbf74adbb34e752c4b7e36cb
MD5 82d01633bc7aa4c08bc271d18406c5e2
SHA1 c7b3f10e5d3a0ada1bd66391e5421196257b2f7e
SHA512 9f0a0194a41e8e935fb08dc51f3a18ea68d9a6c298968044551570ee5b925331f1e4e1adfba854a52a054491d912e2ecbc3e3ad4d59323692b94d0c55400c556
MD5 SHA1 SHA512

Submit Download

magoj.exe

Path C:\Users\Admin\AppData\Local\Temp\magoj.exe
Size 322KB
SHA256 d2604ec503db12f8b806870ae70d111c81eea1dceb48477f3aeb7bb2713c09a3
MD5 0899667f71b77914db0aecb320c65cf5
SHA1 b1af5777331b49a130a99f531cff4666fab4a81b
SHA512 9f82dc6a0ed1099f6130d4aa7532a3fe7baba59d67b42145c3a61ea54c862c082d1f841627e1c2bdbc470dca36f4b8c23b159b0a3d396c69179d2c8f60b8d0a2
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYh:vHW138/iXWlK885rKlGSekcj66ciI
MD5 SHA1 SHA512 SSDEEP

Submit Download

pylic.exe

Path C:\Users\Admin\AppData\Local\Temp\pylic.exe
Size 172KB
SHA256 b17a292735eb3e82da7ba941f240c206f25430dfdf167b09f69d357c8316f9d0
MD5 b9368611bc723ded45d7acd37e5c912a
SHA1 fe988e91c30e2200d303b089f13b2f5eeba50c0e
SHA512 5ad6347be50d8ffc900ac98703782c16d8e7eaf882c6ce82b8646418eb1c7618dcf779339567a15a437acf3262c65d8232e3e2500209427ed50b3414d4632f01
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifk:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1564-19-0x00000000004C0000-0x0000000000541000-memory.dmp

Download

memory/1564-42-0x00000000004C0000-0x0000000000541000-memory.dmp

Download

memory/1564-15-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/1564-13-0x00000000004C0000-0x0000000000541000-memory.dmp

Download

memory/3360-38-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3360-36-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3360-37-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3360-44-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3360-45-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3360-46-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/5004-16-0x0000000000740000-0x00000000007C1000-memory.dmp

Download

memory/5004-0-0x0000000000740000-0x00000000007C1000-memory.dmp

Download

memory/5004-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download