urelas | aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31/08/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
Size 448KB
Sample240831-j4mbdatfkh
SHA256 342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42
MD5 bd3fa5a77300929f8aaf0507d42c6a74
SHA1 a2cee10533ce7bfa7b8a1c4fa51e3a77344c7455
SHA512 31908fab6b77ae34c4c795d469b49cc5326c7983c718ad8d04bf4b33f1f6e65c4f7f8bb9e0477cb691f49ccfb7dc4aac1a1050147f167c02f250d4d3493d1adc
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNh:PMpASIcWYx2U6hAJQnO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2272	nymik.exe
2696	dycuqa.exe
1200	nened.exe

Loads dropped DLL 3 IoCs

pid	Process
976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
2272	nymik.exe
2696	dycuqa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nened.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nymik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dycuqa.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe
1200	nened.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 2272	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	29
PID 976 wrote to memory of 2272	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	29
PID 976 wrote to memory of 2272	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	29
PID 976 wrote to memory of 2272	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	29
PID 976 wrote to memory of 2620	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	30
PID 976 wrote to memory of 2620	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	30
PID 976 wrote to memory of 2620	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	30
PID 976 wrote to memory of 2620	976	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	30
PID 2272 wrote to memory of 2696	2272	nymik.exe	32
PID 2272 wrote to memory of 2696	2272	nymik.exe	32
PID 2272 wrote to memory of 2696	2272	nymik.exe	32
PID 2272 wrote to memory of 2696	2272	nymik.exe	32
PID 2696 wrote to memory of 1200	2696	dycuqa.exe	33
PID 2696 wrote to memory of 1200	2696	dycuqa.exe	33
PID 2696 wrote to memory of 1200	2696	dycuqa.exe	33
PID 2696 wrote to memory of 1200	2696	dycuqa.exe	33
PID 2696 wrote to memory of 480	2696	dycuqa.exe	34
PID 2696 wrote to memory of 480	2696	dycuqa.exe	34
PID 2696 wrote to memory of 480	2696	dycuqa.exe	34
PID 2696 wrote to memory of 480	2696	dycuqa.exe	34

C:\Users\Admin\AppData\Local\Temp\342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
"C:\Users\Admin\AppData\Local\Temp\342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\nymik.exe
  "C:\Users\Admin\AppData\Local\Temp\nymik.exe" hi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\dycuqa.exe
    "C:\Users\Admin\AppData\Local\Temp\dycuqa.exe" OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\nened.exe
      "C:\Users\Admin\AppData\Local\Temp\nened.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1200
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 31e3d0eaec466f3c421549c471e477754e5a1e4bd125dc2d93d77d59d56ac3a5
MD5 37026f7fbb4bfd47d886fa4ae9091567
SHA1 2c55049e8864cf8a973035c3ecf31e2b20a510ce
SHA512 85269c33c0e542fe2c3022ddd3aa82fdbcf87ef50b62cc9b36a07e05314feb1378c2b0972cc6aa18295bccd7e8ff5ee2da41cb446b476023da13da1cffad7b70
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 a1a72c7a2cedea0bb10167af4738e33264bcad0c6e26dbb4b8a6906190533ff6
MD5 bd6d72f91c5516e08c2bff3c78384863
SHA1 d1d7b90527f0d50e3b71e8d6bda66f840f9fb2ec
SHA512 7d62345f91e012097ae656b7188e1487d07f7e727daee84ee517e2a2c09e9ccd58ea47633d49b0351a04b2cd9ec356ee306e52a81ec230ce7e063f995e9e48e4
MD5 SHA1 SHA512

Submit Download

dycuqa.exe

Path C:\Users\Admin\AppData\Local\Temp\dycuqa.exe
Size 448KB
SHA256 635305357f27a26d82ba878c5a7255aed612a274119767c21fe50fecde26ec9a
MD5 14ec8d77427a92248f15152a8cfe5c95
SHA1 1be5617238381864cb5a33f925a648017c8a14c9
SHA512 c02bb30fc38d2ad3ff0bc576019511452065f46df216d114b4dd918e4d63120d2350e24c111bf0d78eb96751b00b9260fd6a2fc7313f4f607ff05f26bf8a8fd6
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNZ:PMpASIcWYx2U6hAJQnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 32b6dbaaf5ad71e47b2444203d18071a8a5b36ead6b9688b7911729932d0cc8b
MD5 ca09bfebb2d43fc68a0730115ae56d71
SHA1 310c2ca8f4f2fd4f9057eae1fe8c4554229d6285
SHA512 6451d9a34357d4774a52b89b80401a7176c5f093ea319629e217116ebec222bbcdaa416560d59a87155887bcb80a3801f8f879e461582afc6910c976a70ca675
MD5 SHA1 SHA512

Submit Download

nened.exe

Path \Users\Admin\AppData\Local\Temp\nened.exe
Size 223KB
SHA256 d0a2432dad5be75d1a6a8bf371567faa19767fec30f38a7c602d5cbeac38733e
MD5 e3b7f2e00ca5f8d58b08197c4f0daf87
SHA1 d44adbdb972ea10775f2244994308b036f99633a
SHA512 67f134c094bc497bd106bfe9c1be349098f6aa0c3da4014089a3256f0e611d13bf06916cc57c8bd78d09bf9b19ecd4157b7b7708b16190180d713289e65ac6c6
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3a:unFhSIkAyDgjtS/FZY
MD5 SHA1 SHA512 SSDEEP

Submit Download

nymik.exe

Path \Users\Admin\AppData\Local\Temp\nymik.exe
Size 448KB
SHA256 6179e164b78927a28cfdf1bde86e78558dc697eee9003bab5fc2409ec7c2d75f
MD5 f579077825bac6975a0773a7ab3cef0b
SHA1 8b24234db2c3646594067d0b9a851cade2aa46b6
SHA512 6e41e73db1eb88140ac116ea4091017fcafb516c305a15682c3bd516b352a78ade8c5f1ce4dd38adb93eb2629f590f8eb445e8cdad2593d771cf6658c964fcc4
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNq:PMpASIcWYx2U6hAJQnB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/976-21-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/976-2-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/976-8-0x00000000024E0000-0x000000000254E000-memory.dmp

Download

memory/1200-55-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/1200-47-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/1200-53-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/1200-54-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/1200-51-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/1200-52-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/2272-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2272-28-0x0000000003580000-0x00000000035EE000-memory.dmp

Download

memory/2272-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2696-30-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2696-35-0x0000000003180000-0x0000000003220000-memory.dmp

Download

memory/2696-45-0x0000000000400000-0x000000000046E000-memory.dmp

Download