urelas | 6e5aa079721bd2c5ad3407fb4ca2cf0b8516f01496998ada3c9f4238ffff545f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe
Size 466KB
Sample240831-lsd7qsxelm
SHA256 a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e
MD5 46e616137797dc894aa5f95d8e6d0716
SHA1 80a9172294f29e7a8c36b0339fdbfb7b8cbb79e6
SHA512 9f37fc457753384153ee618b0c2adbc099a806d7a5e6a0c1386386a78b43d6c36d7d144a93813600d850b41e015fbc6ff4eb40a079f5638741f9c7659daab824
SSDEEP 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwa:AOgwmisETzuaeDPvjJ81VGqK6GvP9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	potaz.exe

Executes dropped EXE 2 IoCs

pid	Process
472	potaz.exe
4884	revel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	potaz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	revel.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe
4884	revel.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 472	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	89
PID 1144 wrote to memory of 472	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	89
PID 1144 wrote to memory of 472	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	89
PID 1144 wrote to memory of 2964	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	90
PID 1144 wrote to memory of 2964	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	90
PID 1144 wrote to memory of 2964	1144	a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe	90
PID 472 wrote to memory of 4884	472	potaz.exe	101
PID 472 wrote to memory of 4884	472	potaz.exe	101
PID 472 wrote to memory of 4884	472	potaz.exe	101

C:\Users\Admin\AppData\Local\Temp\a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe
"C:\Users\Admin\AppData\Local\Temp\a7e99ab4e35c700190f2c91f4a15dae65ce02f91361faa65f416ffba4b0c281e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\potaz.exe
  "C:\Users\Admin\AppData\Local\Temp\potaz.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Users\Admin\AppData\Local\Temp\revel.exe
    "C:\Users\Admin\AppData\Local\Temp\revel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 e320ff0d0ccd4c897386aeda9e102f838e93f9c59604f375fe5d59ffae0ee302
MD5 729552f47d83c411308ff29ae5fce346
SHA1 5b24fa12ecf0f3e4c654ce77bfa1d122935e35b5
SHA512 49d03538e5d6e05ad5dd2b20f0d7646c3b386b7673843234401b0a1703803fbcc31d95933ae66e243e4e724765adbecfee91e4c8cee9041a47d8f763b531cd9a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b5edf453303ef24a0516385c04d99b6dc578f51b783fbc03e0113dbd460cc66f
MD5 cda57f9256708b5e218640d82de0b351
SHA1 1af4b12db6998b4ff05f808c4fcfb636677a53b9
SHA512 eac6c35791dee4540bf9802992dc5dd702e7006c893bc99c5ba329ebd0eed349a83dfc68481ffd1eb045c7eab67ca16dd24e9d66f36b239623afa06f1c78a0c0
MD5 SHA1 SHA512

Submit Download

potaz.exe

Path C:\Users\Admin\AppData\Local\Temp\potaz.exe
Size 466KB
SHA256 cac8680f69e2ff7aa53cbfbe84ba8dcc2f00e5c7cbdb16a24985447a623d0ab4
MD5 a8cef3532d6ba7e788e13f537b186697
SHA1 e4f730a545f47df9e8fcc4027b28d48fba68cf23
SHA512 4179edbe0312e2156bb4450f8971cda734c9b8a693f6aab9192900f944bb9a91316958d82f0081c3e05f3bc6002d6bd23844a778b9627274d9896b50c7f84b54
SSDEEP 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwv:AOgwmisETzuaeDPvjJ81VGqK6GvPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

revel.exe

Path C:\Users\Admin\AppData\Local\Temp\revel.exe
Size 179KB
SHA256 974f3d00e49c5498971cb0feca34653ea7bb9c807fd85ead795bee91760d2303
MD5 173794a97945fc99f52336ad8f2fa18f
SHA1 b017e89c22b34e6af2c33e9ebe588c1153fad800
SHA512 3700bfad141e962d8f48c867e83331447ae55257baf37e3dbfecdea9c97561c58f44951913a86b4803e8f96c22bf15c008fabae96c77ab973554a46475613021
SSDEEP 3072:IFmxsczyRrAO75U+31DjsAZ8yTyZMCAeABPhyPoJz//hMhfWCMHYHZpsoOFL7jcz:IQ2RrAO7zBjsAjTyZMCAeABPuyznkbMO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/472-40-0x0000000000260000-0x0000000000299000-memory.dmp

Download

memory/472-13-0x00000000007C0000-0x00000000007C2000-memory.dmp

Download

memory/472-20-0x0000000000260000-0x0000000000299000-memory.dmp

Download

memory/472-21-0x00000000007C0000-0x00000000007C2000-memory.dmp

Download

memory/472-12-0x0000000000260000-0x0000000000299000-memory.dmp

Download

memory/1144-0-0x0000000000C50000-0x0000000000C89000-memory.dmp

Download

memory/1144-17-0x0000000000C50000-0x0000000000C89000-memory.dmp

Download

memory/1144-1-0x00000000003E0000-0x00000000003E2000-memory.dmp

Download

memory/4884-38-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-42-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-43-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-44-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-45-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-46-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4884-47-0x0000000000400000-0x00000000004BF000-memory.dmp

Download