urelas | b33d5ea80e408978b6931b4fbab48d35fab98a2e48c52d1f9fe5c96626885fb3

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
868a663256099ad7829d60cc2e7af1e0N.exe
Size 322KB
Sample240826-b3kr6axfpb
SHA256 b33d5ea80e408978b6931b4fbab48d35fab98a2e48c52d1f9fe5c96626885fb3
MD5 868a663256099ad7829d60cc2e7af1e0
SHA1 2a16bc507443533ff7d69dd88eb2f7b16532dcb0
SHA512 f7761bab4c362ebc2a0684cc3bbc45711fef04600e403969d3a3798a13df9dca34348036f1fb01cc341cf5bdd5f82d38b9cdf9699d0bf1fef97376d367cf524c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYt:vHW138/iXWlK885rKlGSekcj66ci8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	868a663256099ad7829d60cc2e7af1e0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	ynujg.exe

Executes dropped EXE 2 IoCs

pid	Process
3816	ynujg.exe
3612	icyzh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icyzh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	868a663256099ad7829d60cc2e7af1e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ynujg.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe
3612	icyzh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3816	3948	868a663256099ad7829d60cc2e7af1e0N.exe	90
PID 3948 wrote to memory of 3816	3948	868a663256099ad7829d60cc2e7af1e0N.exe	90
PID 3948 wrote to memory of 3816	3948	868a663256099ad7829d60cc2e7af1e0N.exe	90
PID 3948 wrote to memory of 4872	3948	868a663256099ad7829d60cc2e7af1e0N.exe	91
PID 3948 wrote to memory of 4872	3948	868a663256099ad7829d60cc2e7af1e0N.exe	91
PID 3948 wrote to memory of 4872	3948	868a663256099ad7829d60cc2e7af1e0N.exe	91
PID 3816 wrote to memory of 3612	3816	ynujg.exe	104
PID 3816 wrote to memory of 3612	3816	ynujg.exe	104
PID 3816 wrote to memory of 3612	3816	ynujg.exe	104

C:\Users\Admin\AppData\Local\Temp\868a663256099ad7829d60cc2e7af1e0N.exe
"C:\Users\Admin\AppData\Local\Temp\868a663256099ad7829d60cc2e7af1e0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\ynujg.exe
  "C:\Users\Admin\AppData\Local\Temp\ynujg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\icyzh.exe
    "C:\Users\Admin\AppData\Local\Temp\icyzh.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 4e4857b59c80f3166fe83d187a76afa6acb4be83d2481f09eaa106cda44185ea
MD5 560a345a234482678b0023dbdafbd489
SHA1 875e9a50fa8a41af9dd108e511cd12f852d40957
SHA512 88fc302e1101a2a0e3f67494226991d1719f26a584c11516413eb0d60146f305ad82c6710f0458cf2460a3e3237b4d445aeee02924cf5d6f1cfc4fd642e9b0b4
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 383942ef6738f20bf023cd5e966ce051cfce5f9e0544b86b749f1a8e5075aec4
MD5 0c95bd1e2b4e17fc979916afdec473d2
SHA1 01298e2109f5071bff84f9f7ff394d563059688b
SHA512 3ccecc0ad186918a4d66e88e5fb88ffd483ff5e7a23496f482286c73d38f811515cbfcb4bef447b6df67d27e9ad3d43ccdf6dca73315be7e15dc725d672ab617
MD5 SHA1 SHA512

Submit Download

icyzh.exe

Path C:\Users\Admin\AppData\Local\Temp\icyzh.exe
Size 172KB
SHA256 6beea2df76d60429ae6133dc7bda3b0c5854d6c4795368f65e825b92ef1fbce3
MD5 1756fe227316f4f17da7d64d8a1efa51
SHA1 73d5e5ea819b0c988e5bb8e6aac9541b2684e359
SHA512 0ae66c55d839fab210b8ecd33e7a825173a5be3929cce8aceec7f03cff4bc0d7d6c2ad07b1aabe82c61757260ba33b6b03526b206bad9d3b03e664fc38d8120b
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifF:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ynujg.exe

Path C:\Users\Admin\AppData\Local\Temp\ynujg.exe
Size 322KB
SHA256 a52c68392eabd0b711e35d19662bfab38550a24a38c8430fad826af55b82f8bb
MD5 4272dde8b94074d74d756287a308ba36
SHA1 831a0a5321bbcb1e6530cf185ad30c39b0111cf6
SHA512 1d81189895f69cd5898548df72e90c3fc22c44462ad5a0082ae50665a7067d7c0500cca4404d477a690abb1ee61700855a6d6d46b31307cc4ecc05e1cba23cbf
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY1:vHW138/iXWlK885rKlGSekcj66ciM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3612-38-0x0000000000D50000-0x0000000000D52000-memory.dmp

Download

memory/3612-47-0x0000000000CA0000-0x0000000000D39000-memory.dmp

Download

memory/3612-46-0x0000000000CA0000-0x0000000000D39000-memory.dmp

Download

memory/3612-45-0x0000000000D50000-0x0000000000D52000-memory.dmp

Download

memory/3612-37-0x0000000000CA0000-0x0000000000D39000-memory.dmp

Download

memory/3612-39-0x0000000000CA0000-0x0000000000D39000-memory.dmp

Download

memory/3816-20-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/3816-43-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/3816-11-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/3816-14-0x00000000004E0000-0x00000000004E1000-memory.dmp

Download

memory/3948-0-0x00000000003E0000-0x0000000000461000-memory.dmp

Download

memory/3948-17-0x00000000003E0000-0x0000000000461000-memory.dmp

Download

memory/3948-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download