urelas | aa4e3c731f327d0b0a2252aba8219de2d1e468e9bd65d62489fdb237731070e3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
Size 448KB
Sample240831-j4mbdatfkh
SHA256 342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42
MD5 bd3fa5a77300929f8aaf0507d42c6a74
SHA1 a2cee10533ce7bfa7b8a1c4fa51e3a77344c7455
SHA512 31908fab6b77ae34c4c795d469b49cc5326c7983c718ad8d04bf4b33f1f6e65c4f7f8bb9e0477cb691f49ccfb7dc4aac1a1050147f167c02f250d4d3493d1adc
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNh:PMpASIcWYx2U6hAJQnO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	izyjq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	uzyfco.exe

Executes dropped EXE 3 IoCs

pid	Process
620	izyjq.exe
3576	uzyfco.exe
3856	senoy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izyjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzyfco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	senoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe
3856	senoy.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 620	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	87
PID 860 wrote to memory of 620	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	87
PID 860 wrote to memory of 620	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	87
PID 860 wrote to memory of 4288	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	88
PID 860 wrote to memory of 4288	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	88
PID 860 wrote to memory of 4288	860	342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe	88
PID 620 wrote to memory of 3576	620	izyjq.exe	90
PID 620 wrote to memory of 3576	620	izyjq.exe	90
PID 620 wrote to memory of 3576	620	izyjq.exe	90
PID 3576 wrote to memory of 3856	3576	uzyfco.exe	102
PID 3576 wrote to memory of 3856	3576	uzyfco.exe	102
PID 3576 wrote to memory of 3856	3576	uzyfco.exe	102
PID 3576 wrote to memory of 5068	3576	uzyfco.exe	103
PID 3576 wrote to memory of 5068	3576	uzyfco.exe	103
PID 3576 wrote to memory of 5068	3576	uzyfco.exe	103

C:\Users\Admin\AppData\Local\Temp\342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe
"C:\Users\Admin\AppData\Local\Temp\342f02218dac4be3b76e26d7835b1f18521f5c015365af487c7cb9e055ec6d42.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\izyjq.exe
  "C:\Users\Admin\AppData\Local\Temp\izyjq.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\uzyfco.exe
    "C:\Users\Admin\AppData\Local\Temp\uzyfco.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\senoy.exe
      "C:\Users\Admin\AppData\Local\Temp\senoy.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 bd4c0e6f48eda322126bccd5b7fc4b6731a6bcb4e4b987f3c26d19c5091491aa
MD5 c2ab34f89eb6eeb224e4ad656b6a96d6
SHA1 35725500812c16302ef343f3f6bbc2ff1e42ae64
SHA512 519e0d85c3512748ba5d610a382544b727f60bd1e2275286e3503fb396534f084a9e2dbd4232344a21a5679805866c8afeff59da9ddfb85c61c685072aa90585
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 31e3d0eaec466f3c421549c471e477754e5a1e4bd125dc2d93d77d59d56ac3a5
MD5 37026f7fbb4bfd47d886fa4ae9091567
SHA1 2c55049e8864cf8a973035c3ecf31e2b20a510ce
SHA512 85269c33c0e542fe2c3022ddd3aa82fdbcf87ef50b62cc9b36a07e05314feb1378c2b0972cc6aa18295bccd7e8ff5ee2da41cb446b476023da13da1cffad7b70
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 fb5390c815edc6a34f71ef29c98b82b45574cb0f2d9fbd243d88016ef1eb749a
MD5 11c419902bd214ee0b9be06eb34656ff
SHA1 94664009e3f53fc9b2b4011a6dc218bfd7462026
SHA512 9fc5bd04326722c9d7c517b7dd1b029f87a7c6e8d9fe5705bb66071ea6071bdc4514e83476b69c076d2c80dd605e5e74e99ae73548e21209d210cd236818d50c
MD5 SHA1 SHA512

Submit Download

izyjq.exe

Path C:\Users\Admin\AppData\Local\Temp\izyjq.exe
Size 448KB
SHA256 ca265485f21cc85468514ff3b3ea2ae0ea69b6fde14f041205fefec255af415a
MD5 6afd7d61afd8457f695d48aa72d6944e
SHA1 b625e7e93175ce6638ab378b4ab7901a4ab61c75
SHA512 3abd47a12d3e1ef8c54d0eb165a07a782afbe7b737171b88061812dd136ea0d082ce620fa355119d37c23fad3397701333b7123f36467443461e1d9db7b81108
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomN/:PMpASIcWYx2U6hAJQnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

senoy.exe

Path C:\Users\Admin\AppData\Local\Temp\senoy.exe
Size 223KB
SHA256 a407d0dcc258a14b7ecd2d7ce67faadd4354e831bc3917b6769af7c5c80344c8
MD5 eb42ab05422ef11aba35027b769c641f
SHA1 85cbc51100e882024f829451af0b527d41304571
SHA512 b62b0c6f2f96fb454e5d51c450217a76d3ea616e4ce56428798cbbec8922236ed90ede3ee58259097f850436552a202db6f4a5d25635f61cd886018441f8afb6
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3L:unFhSIkAyDgjtS/FZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzyfco.exe

Path C:\Users\Admin\AppData\Local\Temp\uzyfco.exe
Size 448KB
SHA256 c4eba403cef8109fd9d9f925a359ea3c56ba6a69707c48b9f1dbe31e397ac0eb
MD5 6cbd5eb831cdaa7cc853c7892b03b670
SHA1 a4b0f75fd4cdad0b263698f5620a0f9aad1f8c2a
SHA512 2a5b53749e9079357772ae5a7499bf6659b322c46e35cc2b15d71d914d042a761a467a95b0d3dc62c2df66212f93ce57c281177c7eea64aa3853c69f78f8b263
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomNe:PMpASIcWYx2U6hAJQnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-23-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/860-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/860-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3576-25-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3576-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3856-36-0x0000000000790000-0x0000000000830000-memory.dmp

Download

memory/3856-41-0x0000000000790000-0x0000000000830000-memory.dmp

Download

memory/3856-42-0x0000000000790000-0x0000000000830000-memory.dmp

Download

memory/3856-43-0x0000000000790000-0x0000000000830000-memory.dmp

Download

memory/3856-44-0x0000000000790000-0x0000000000830000-memory.dmp

Download

memory/3856-45-0x0000000000790000-0x0000000000830000-memory.dmp

Download