urelas | 5660b3292b90fa4b33efa0021d5e8ecad1d70c1e8a65a0d963555c19ad01f513

Analysis

max time kernel
119s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d860f606fbe23d841116616bc4cd5a10N.exe
Size 323KB
Sample240827-vtthgstbll
SHA256 5660b3292b90fa4b33efa0021d5e8ecad1d70c1e8a65a0d963555c19ad01f513
MD5 d860f606fbe23d841116616bc4cd5a10
SHA1 a9cf5d65c1151d18dd7020b431278a9ab78d1b75
SHA512 2b15c414af48b0a46bf3e6ebaae7d331124bfa00a5a80b95ecd7e63acee500f10cb67ae403a1648c8091941a608379722a4d1ddbb2e2a02fb6d15f22b4f7a64d
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYu:vHW138/iXWlK885rKlGSekcj66ciP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	d860f606fbe23d841116616bc4cd5a10N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	tysin.exe

Executes dropped EXE 2 IoCs

pid	Process
1000	tysin.exe
1688	emwes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tysin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emwes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d860f606fbe23d841116616bc4cd5a10N.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe
1688	emwes.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1000	4932	d860f606fbe23d841116616bc4cd5a10N.exe	90
PID 4932 wrote to memory of 1000	4932	d860f606fbe23d841116616bc4cd5a10N.exe	90
PID 4932 wrote to memory of 1000	4932	d860f606fbe23d841116616bc4cd5a10N.exe	90
PID 4932 wrote to memory of 3892	4932	d860f606fbe23d841116616bc4cd5a10N.exe	91
PID 4932 wrote to memory of 3892	4932	d860f606fbe23d841116616bc4cd5a10N.exe	91
PID 4932 wrote to memory of 3892	4932	d860f606fbe23d841116616bc4cd5a10N.exe	91
PID 1000 wrote to memory of 1688	1000	tysin.exe	104
PID 1000 wrote to memory of 1688	1000	tysin.exe	104
PID 1000 wrote to memory of 1688	1000	tysin.exe	104

C:\Users\Admin\AppData\Local\Temp\d860f606fbe23d841116616bc4cd5a10N.exe
"C:\Users\Admin\AppData\Local\Temp\d860f606fbe23d841116616bc4cd5a10N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\tysin.exe
  "C:\Users\Admin\AppData\Local\Temp\tysin.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\emwes.exe
    "C:\Users\Admin\AppData\Local\Temp\emwes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 aa40f743c35d17a6e2a4c6faf6214d00c476e5a4c8f100a579a56a2c4e8c1577
MD5 dfe387a1442a8d66e32faf2dfc84dd4d
SHA1 653549303aa9d902d802963f0233ddc30fb54dec
SHA512 21a337e730ce8407b8f5d68d1c7604104069c8aaccde74f0634ea0e6f42fb8b2b9e0ecb7e84bbf2c3a1a17d99bd7e8646bd6df41a6756587aa66b5d6afb77e23
MD5 SHA1 SHA512

Submit Download

emwes.exe

Path C:\Users\Admin\AppData\Local\Temp\emwes.exe
Size 172KB
SHA256 da13ea68e507ae4c15f8ac8427f75744c305f159e7309676788aa1838c359c52
MD5 3b10ccaef5c2fd06feace3e0cf1bb6f9
SHA1 c4b4d8df6099178b4dd2603b02c5c0792b19f7ab
SHA512 1c66e76f3dc630524d38b0fecaf85e2d48422ccb67ec208ab7057d38bcb05e7ce1c0170c047ebb838120d8b07ad5c63f77226b56411c70268e328f13b330939b
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif+:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 664f5f66d68ce76b180418cc3f4be9d4b0416ff24bccab2760a8030ab37374cb
MD5 3d5432a987bef2e13ff3f1e28ce1c8aa
SHA1 b0da8d143abfe91b406fb5cc45c7488150bf3217
SHA512 a31b64e8727dc130c56f6fcb0c7e21c437db5ac8ca791741fd341f90953d2b3e876b3a82d736ed3f28497f09e0531dd046a9ae0cec27fe017984b4bc92855a40
MD5 SHA1 SHA512

Submit Download

tysin.exe

Path C:\Users\Admin\AppData\Local\Temp\tysin.exe
Size 323KB
SHA256 f3a8fbe14ef7a06b4195b2736bd578060781db026fee7499daf15d375cf470fb
MD5 158126a0614a5c052f6c6f86511f4c78
SHA1 a76bf6a26df4a68b5d7dadadc684c565fa41360d
SHA512 aedba2cbfbcebbe0b3447c4233ba4aaa4d59bb817c6d4cf076f4f1d5fdc010e93f5398e98aacf316959e955f045bfe9e75f02ca23149604403fe9fa17fc3289c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY+:vHW138/iXWlK885rKlGSekcj66cif
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1000-20-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/1000-14-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/1000-10-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/1000-43-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/1688-38-0x0000000001100000-0x0000000001102000-memory.dmp

Download

memory/1688-39-0x0000000000760000-0x00000000007F9000-memory.dmp

Download

memory/1688-37-0x0000000000760000-0x00000000007F9000-memory.dmp

Download

memory/1688-45-0x0000000001100000-0x0000000001102000-memory.dmp

Download

memory/1688-46-0x0000000000760000-0x00000000007F9000-memory.dmp

Download

memory/1688-47-0x0000000000760000-0x00000000007F9000-memory.dmp

Download

memory/4932-17-0x0000000000820000-0x00000000008A1000-memory.dmp

Download

memory/4932-0-0x0000000000820000-0x00000000008A1000-memory.dmp

Download

memory/4932-1-0x0000000001220000-0x0000000001221000-memory.dmp

Download