urelas | 6d4b25ec326231d0f838e207ee6ec6e2f4f551292576209ccd0d8e42888bfe28

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe
Size 448KB
Sample240901-wnazmaxfkr
SHA256 9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5
MD5 61e367150d3762422d388b12bfd73d3f
SHA1 2cd87ffca2517d6a609ff59682cc96e23584e738
SHA512 3536f3b964fa551686f2ca083289193f6e4a7747697910257955a1d29307a24147b8d50d3a86ed7d2c97503369cd95565c12f103c2d073a3c9810e3ea59139a9
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoji:PMpASIcWYx2U6hAJQnS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	doefi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	nuebun.exe

Executes dropped EXE 3 IoCs

pid	Process
1712	doefi.exe
3552	nuebun.exe
3516	ybzob.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ybzob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doefi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuebun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe
3516	ybzob.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1712	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	84
PID 2232 wrote to memory of 1712	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	84
PID 2232 wrote to memory of 1712	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	84
PID 2232 wrote to memory of 2700	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	85
PID 2232 wrote to memory of 2700	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	85
PID 2232 wrote to memory of 2700	2232	9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe	85
PID 1712 wrote to memory of 3552	1712	doefi.exe	87
PID 1712 wrote to memory of 3552	1712	doefi.exe	87
PID 1712 wrote to memory of 3552	1712	doefi.exe	87
PID 3552 wrote to memory of 3516	3552	nuebun.exe	99
PID 3552 wrote to memory of 3516	3552	nuebun.exe	99
PID 3552 wrote to memory of 3516	3552	nuebun.exe	99
PID 3552 wrote to memory of 2024	3552	nuebun.exe	100
PID 3552 wrote to memory of 2024	3552	nuebun.exe	100
PID 3552 wrote to memory of 2024	3552	nuebun.exe	100

C:\Users\Admin\AppData\Local\Temp\9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe
"C:\Users\Admin\AppData\Local\Temp\9806575fa0dec2cc110cd3c51d1ecc25cfb6a7d36739124204223bcd7ef6eeb5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\doefi.exe
  "C:\Users\Admin\AppData\Local\Temp\doefi.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\nuebun.exe
    "C:\Users\Admin\AppData\Local\Temp\nuebun.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\ybzob.exe
      "C:\Users\Admin\AppData\Local\Temp\ybzob.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 b33de3b77f55fb19cf17a43e33c01a3fd86e549c5b538399dff9ac3bfced1cf7
MD5 d4cf29c32c48c06d3a529d9067912482
SHA1 62e04191d8132323b98da6b3f03ba24cff5e648e
SHA512 901472db2673b979a709e8c661e170c16d71a082ca1f7442636b6de807855df39a4e854792c24a3d62d4f76aae11ab39cf3049c0065b7ff4b6192449f3757453
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 d4e1425d9a05f5055d75a98f595a163c86bb2f280d8e35ff2a465d447094c9f2
MD5 4f23019631d24be82a171f30d2a62d33
SHA1 3d5b7b2bf23abe46bd2b2aa886a5f294d8d5b61b
SHA512 090d7039f93457bd0fa889ddd060f6986e67f56a33a89636cc89f61297d132583b3038ef4673b542e1ec64009529793b12d546524e124c2e542e97be21a70ffe
MD5 SHA1 SHA512

Submit Download

doefi.exe

Path C:\Users\Admin\AppData\Local\Temp\doefi.exe
Size 448KB
SHA256 d5a4569b32c32918dd8da62331ee9bc6ef1dace320ebc29747b39929eb8e7ebe
MD5 857a308c48b1276c5a20f43814f04d42
SHA1 42994f010e2fdddacd4cc6e884d3630d20522e13
SHA512 1d977a81b2ec57e53d9f0557bbf88886dca21906773abda961ccb668898bf47187eeff8313e20473a161a4b6bcdacd3266eaa5b86038ed625156fd89f239f73c
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpojW:PMpASIcWYx2U6hAJQnm
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 39581b565429ce501889e289f23b8afcb09d1aa5dbe8c27e9781f3ed75d65514
MD5 71ae16cb33d8868936fa39a424a25957
SHA1 d9916260697562ed95b14c92c34291b667a7d23b
SHA512 cd3a68fdf5cbd57961905e3691421bd898e57ade5d9f2a820224c9395ce0ed151c210fca63cf73c5065f83e3f2144c0df4c724861ee9170a3d48660aae19dc00
MD5 SHA1 SHA512

Submit Download

nuebun.exe

Path C:\Users\Admin\AppData\Local\Temp\nuebun.exe
Size 448KB
SHA256 7f828fef006bd979d881db83abdff2dc68774244b09b95ba7b4516146c2a0b38
MD5 6125d9759641198a99932fba5c8a4366
SHA1 c95f316909e39a500d2ddb3a6e8167215dc28502
SHA512 b49d7911bd4e6ee9d89ba3d5b68efd4e75b35d5be5561ccb7dcc671b641674fa5e7b77ebcc18ebc679bd9d552bff61cd6ef3183b24a6c65eeb15bf5e4ba8fb1c
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpojb:PMpASIcWYx2U6hAJQnr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybzob.exe

Path C:\Users\Admin\AppData\Local\Temp\ybzob.exe
Size 223KB
SHA256 04d938c3c3662053528ccb942b17a2487ac4c0ce97633bdd15e53892c4ccb92e
MD5 c5de7292838b2f6d44d6b5eada4ae586
SHA1 31a775bfade7af13a90e31e8d82a8671fad2bb0c
SHA512 a542e77adc6424450e688aa91792cca2fd7d96c247a7bd72c96eb56f9b51a67dfc1f2f605517c8d1e341f273971756454f0db0cc04e55e251e3d0d633dc772a0
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3y:unFhSIkAyDgjtS/FZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1712-24-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2232-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2232-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3516-35-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3516-41-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3516-42-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3516-43-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3516-44-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3516-45-0x0000000000AF0000-0x0000000000B90000-memory.dmp

Download

memory/3552-25-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3552-39-0x0000000000400000-0x000000000046E000-memory.dmp

Download