urelas | d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe
Size 326KB
Sample240826-edp75atbjd
SHA256 d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280
MD5 77bbc83be5720ff220b9020e85402279
SHA1 ffe04dc64d6a667503d45f7a610a3e88901a3aa7
SHA512 0ca1d7913806f02934c181d10b7216a90c46fa0527718c059bd05c58685674909e7b489aaf8703c93309d13ea44849908aa5c603ce274825c020fee195fb28da
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYA:vHW138/iXWlK885rKlGSekcj66ciV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	sygei.exe

Executes dropped EXE 2 IoCs

pid	Process
1944	sygei.exe
3604	judav.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sygei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	judav.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe
3604	judav.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1944	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	88
PID 4472 wrote to memory of 1944	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	88
PID 4472 wrote to memory of 1944	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	88
PID 4472 wrote to memory of 3688	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	89
PID 4472 wrote to memory of 3688	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	89
PID 4472 wrote to memory of 3688	4472	d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe	89
PID 1944 wrote to memory of 3604	1944	sygei.exe	102
PID 1944 wrote to memory of 3604	1944	sygei.exe	102
PID 1944 wrote to memory of 3604	1944	sygei.exe	102

C:\Users\Admin\AppData\Local\Temp\d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe
"C:\Users\Admin\AppData\Local\Temp\d8af627b28984fa63e5c8b8002f8ac40bf50263c9515f0318645124fd4af6280.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Temp\sygei.exe
  "C:\Users\Admin\AppData\Local\Temp\sygei.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\judav.exe
    "C:\Users\Admin\AppData\Local\Temp\judav.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 14703f1d331ab64950bc0e6f9a57a4ff4610e7c4994d0d674b8dc2a70d318864
MD5 1c50067ac3b7b65fed40bb1a38cb653f
SHA1 e2542c9915aac426e7f4d48b74ac182b2307044c
SHA512 17bda1abb459740709f79ea113bfe565c82421c99f11647e76fffc6c09526f653637d682799ffcc9109cd85ea59158d748ef95b761e0a5a88cddbbf888131a8c
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 feea8f0d6c0aae4cce0a33aedcae16d470a3c0ee2ca11054b16c6b88aae4abc0
MD5 f4286d529c8b5f8dbf3f7b46e53a15e7
SHA1 713c5353ce69e4b6981e3b534c6c3efd3180796d
SHA512 7ff4d9e2a3cc438f863903a9daf24675e1734b58403c705ef9e102cdc8e9d55dfa470dac61579e8adf1ebb856eb6661608d07ca321f3c5f73e9d9a3b92e1e3d9
MD5 SHA1 SHA512

Submit Download

judav.exe

Path C:\Users\Admin\AppData\Local\Temp\judav.exe
Size 172KB
SHA256 25b837274b0f7fea36fdfaa4773f7fbd6ff11d73fe606eee385581242f75128a
MD5 61bfe60af2bdbdb40aa6c374298735fa
SHA1 37c958e9649de72ae86be03fb66e97b77c1f77de
SHA512 53d26105e07b9ee3fb3fff951d6e9f3e80cae485619028a3f7a8c34e71b925ee4025ec6fbc025e1007bd1f225821d97d90b4385bcd20a78585a2e578d5b5e304
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif+:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sygei.exe

Path C:\Users\Admin\AppData\Local\Temp\sygei.exe
Size 326KB
SHA256 80d619b6dc4c134f2aec874a068102b4bb67ae53976741595bd776a8d638c8db
MD5 83a4ed0ea6fe6cbce6794249312f127d
SHA1 d84fbdc7458634968d93e4951771cd822613715d
SHA512 e1b172586b4b33747c48a05098fb3d1acad7c9ac5ce9ba5d8ded76ade401e7ec6d096954ae669ba1ef92ac757f7a8becbfa2bc8972270b6bf5737981fd3b9808
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYx:vHW138/iXWlK885rKlGSekcj66ciY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1944-21-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1944-39-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Download

memory/1944-11-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Download

memory/1944-14-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1944-20-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Download

memory/3604-46-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-44-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-40-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-43-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-47-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-48-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-49-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-50-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/3604-51-0x0000000000670000-0x0000000000709000-memory.dmp

Download

memory/4472-17-0x0000000000580000-0x0000000000601000-memory.dmp

Download

memory/4472-1-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4472-0-0x0000000000580000-0x0000000000601000-memory.dmp

Download