urelas | 3fd038e94fd423edc6d17a5d97261f16e32782f931a2ad97be227d0bcad9cc24

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
942589df29fd2c2e861d31cef2579530N.exe
Size 323KB
Sample240831-l4eyeayblc
SHA256 3fd038e94fd423edc6d17a5d97261f16e32782f931a2ad97be227d0bcad9cc24
MD5 942589df29fd2c2e861d31cef2579530
SHA1 fade3d3e7a0b03c711d272f8fcc42ef4d062ba9e
SHA512 e46aa3d95cb1b07e604de3668315bb2ec4b790b9233f0f2942419225ff2fd66d23b4154f4648e9f953f3e6493306ca05f79ad2145b311b302705cf1b45329dea
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYF:vHW138/iXWlK885rKlGSekcj66cis
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	942589df29fd2c2e861d31cef2579530N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	sofaj.exe

Executes dropped EXE 2 IoCs

pid	Process
4852	sofaj.exe
3432	cevij.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cevij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	942589df29fd2c2e861d31cef2579530N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sofaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe
3432	cevij.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4852	1216	942589df29fd2c2e861d31cef2579530N.exe	91
PID 1216 wrote to memory of 4852	1216	942589df29fd2c2e861d31cef2579530N.exe	91
PID 1216 wrote to memory of 4852	1216	942589df29fd2c2e861d31cef2579530N.exe	91
PID 1216 wrote to memory of 2148	1216	942589df29fd2c2e861d31cef2579530N.exe	92
PID 1216 wrote to memory of 2148	1216	942589df29fd2c2e861d31cef2579530N.exe	92
PID 1216 wrote to memory of 2148	1216	942589df29fd2c2e861d31cef2579530N.exe	92
PID 4852 wrote to memory of 3432	4852	sofaj.exe	103
PID 4852 wrote to memory of 3432	4852	sofaj.exe	103
PID 4852 wrote to memory of 3432	4852	sofaj.exe	103

C:\Users\Admin\AppData\Local\Temp\942589df29fd2c2e861d31cef2579530N.exe
"C:\Users\Admin\AppData\Local\Temp\942589df29fd2c2e861d31cef2579530N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\sofaj.exe
  "C:\Users\Admin\AppData\Local\Temp\sofaj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\cevij.exe
    "C:\Users\Admin\AppData\Local\Temp\cevij.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 87afde882e92397e45cd116740b6bbe26245b0cf935225ea10dc60cd36c0d903
MD5 acf5983a1d06a18f22eaa71e2d5d4212
SHA1 8dfb03d2110220108e48547d936ead6f887f4e9c
SHA512 5d60f14e883c304cb592aec04e10e42a6c1d1e7b9cf9299d4b1e6abd18e6fa535d7151755be1dffeddddfb983853bf62678f26bb8a6c62cfe81fcbcaeb6bcdba
MD5 SHA1 SHA512

Submit Download

cevij.exe

Path C:\Users\Admin\AppData\Local\Temp\cevij.exe
Size 172KB
SHA256 8e23f33d603e4e98ea7263cc013f9068e7efd8eb6698b3f1d30fcc4481660412
MD5 d397cd6b92ce846187906fdd2c5abb9c
SHA1 45004afa5c1114c7efece0f2ffb6171edd6605f6
SHA512 56948eb4baa0bb2149fbb2a767fbc7ed102a77f013fe394ae11a419fcafefa1f698bdee8d193948fcc43a8ed578554f61db6dfd8004852184e9f04dcaa6ddfb6
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifj:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX1
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b75b658856b3d85a5a29e6c0230c969d97058a1440805cb4ab366e3ff6efaec6
MD5 10f9bd6993b36c74f446718d531b4e8b
SHA1 0ba73f7de3e9c0c5ddb429a5e42ec8aaa422748e
SHA512 56976a011fd284dcbbdf6bf9f2cdd085d2c124a16f4126074a7b5cab3853773d53d7a80e0d90d7f4e020a945bcbc9f23e1ab579c8a3e07a156d874e6f17172c9
MD5 SHA1 SHA512

Submit Download

sofaj.exe

Path C:\Users\Admin\AppData\Local\Temp\sofaj.exe
Size 323KB
SHA256 dd7fc61c76b24299c72e92e744b2e6a15590c133bd8815e2d92914c05e79bf68
MD5 076e0a041a1574a588f22f30014dab2b
SHA1 df24f0e6b0330284a7a2aaf038f5115dab7d0827
SHA512 9636c65fc9f9babfe9a63b94a7f46b7dced4bc37c8c6f81ba25d8dca182df25650977d41a23bac09d06539a119d1bebb3aff92a5602c1fa70788f9ed19f888c6
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYB:vHW138/iXWlK885rKlGSekcj66ci4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1216-1-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/1216-0-0x0000000000950000-0x00000000009D1000-memory.dmp

Download

memory/1216-17-0x0000000000950000-0x00000000009D1000-memory.dmp

Download

memory/3432-39-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/3432-47-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/3432-46-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/3432-45-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/3432-38-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4852-13-0x0000000000940000-0x00000000009C1000-memory.dmp

Download

memory/4852-43-0x0000000000940000-0x00000000009C1000-memory.dmp

Download

memory/4852-21-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/4852-20-0x0000000000940000-0x00000000009C1000-memory.dmp

Download

memory/4852-14-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download