urelas | 3448e29b943ccc42758cfa62d39c7a71f036007e75a7a97831d65f4b290076ce

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe
Size 349KB
Sample240831-p68v2svbmd
SHA256 fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d
MD5 0f96858bafeb8465312ec417adfafa5a
SHA1 d81cdb2ff5d51950a3482135c7a667d5f5cc60cc
SHA512 47fc6857db288f37824f2d484ed048549e011b23dbebfb3c9130708645339e58f4a1031ed2a74ecfc0d7e21dce9f1c7d7d2a1779a24c2868dc60f29f47af3288
SSDEEP 6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZI0:A0G5obGGraOpUWlpO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	ovufx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	vydyti.exe

Executes dropped EXE 3 IoCs

pid	Process
2236	ovufx.exe
404	vydyti.exe
1604	duasv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ovufx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vydyti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duasv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe
1604	duasv.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2236	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	91
PID 3492 wrote to memory of 2236	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	91
PID 3492 wrote to memory of 2236	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	91
PID 3492 wrote to memory of 4260	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	92
PID 3492 wrote to memory of 4260	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	92
PID 3492 wrote to memory of 4260	3492	fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe	92
PID 2236 wrote to memory of 404	2236	ovufx.exe	94
PID 2236 wrote to memory of 404	2236	ovufx.exe	94
PID 2236 wrote to memory of 404	2236	ovufx.exe	94
PID 404 wrote to memory of 1604	404	vydyti.exe	110
PID 404 wrote to memory of 1604	404	vydyti.exe	110
PID 404 wrote to memory of 1604	404	vydyti.exe	110
PID 404 wrote to memory of 1804	404	vydyti.exe	111
PID 404 wrote to memory of 1804	404	vydyti.exe	111
PID 404 wrote to memory of 1804	404	vydyti.exe	111

C:\Users\Admin\AppData\Local\Temp\fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe
"C:\Users\Admin\AppData\Local\Temp\fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\ovufx.exe
  "C:\Users\Admin\AppData\Local\Temp\ovufx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\vydyti.exe
    "C:\Users\Admin\AppData\Local\Temp\vydyti.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\duasv.exe
      "C:\Users\Admin\AppData\Local\Temp\duasv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 e826b02b0cf8f9f48e647f7f07c0b7ee81109e12de109d7e3101ca569e1476c9
MD5 fdb12e37744219eb0d793ea571de2b75
SHA1 bab27c9927f7b2228d66b9f489a891fb946415d0
SHA512 22c2ff308a297527142109e221261c24b7e1a58ab8d63217229b1cba7e5df792ee9b1140377ac6e20c6203efa37d9633bd8d25d1e7157a9347c4834f2ee73728
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 db2abdf253442d6c7702b4577d73bd924f0df0013c43d3850a3e43482613bc76
MD5 99c7b22c130ac9c776177d1e77b0dc05
SHA1 a05ac23504d4022b8d3d2e55f66bad2106be7b3e
SHA512 9e27226ce11444a56a0d48677444d523ce5220dc8440110fd9d87346001da945dfc34c2e442b680ea2e3ddcc35c0436024dfa803027bb69c8d8e1e6b7300103e
MD5 SHA1 SHA512

Submit Download

duasv.exe

Path C:\Users\Admin\AppData\Local\Temp\duasv.exe
Size 115KB
SHA256 07d5ff34e4f65db7b92c0c04f60d99cae16953e5a8cda694796bcda501bacf48
MD5 2fc02870454c92f67048d603f3e396b3
SHA1 d286a106376432dfbf0d50418a765aa14079de31
SHA512 73328a3b9eb3c8c617f53af898be1da276a5fd2571db26f20e6a85ccd104deeb5be6082cc9ce3b3cabc5a117fd84b8a96e23dc2c6977a1390d58f089aa7d105a
SSDEEP 1536:jL9ubrni7nDh0ESGftf9qAv1O5dyq0P1Lp6x8pmHg4Ch4AmC:jpinaWESKtkYkFI65E6AmC
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3d2d1ade28642606fb7705b1f3f46075c7d52ad14bb559145220f6409fc7e4bc
MD5 0d3ebe4f701ce7d4115883ef2479e4ce
SHA1 e108b0b72eee5049b0db018dd190058a8ea958ab
SHA512 25f9a22ee6955535d8fa6ac524a994ad1a233bb3235bef8679590dfd545316848a83f122d54a82857deb309dc8aa158fea909c2de5f5e7cc95f465670f0c63dc
MD5 SHA1 SHA512

Submit Download

ovufx.exe

Path C:\Users\Admin\AppData\Local\Temp\ovufx.exe
Size 349KB
SHA256 49432b3a7a9c887d368c789f26c951b74e880c9f7e2d907c08a9597294700e42
MD5 d6eed2d677470b026e70e5c86a8bc818
SHA1 a76693eb3daee57005b633201178c751960e06b4
SHA512 e4a56299563287645a1eec6c1e8789e068fc373c99c50edbebe311daf53bf7de70d6882478c35e2efb0357191c32a32ad6eb3f9827dc16e874a22616c09fb187
SSDEEP 6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZIF:A0G5obGGraOpUWlpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-39-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/404-25-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1604-36-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-41-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-42-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-43-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-44-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-45-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/1604-46-0x0000000000680000-0x0000000000702000-memory.dmp

Download

memory/2236-24-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3492-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3492-15-0x0000000000400000-0x000000000045C000-memory.dmp

Download