urelas | a27ddebd49a1f0c363f420450e1dea9d3fd168381b7e014cba1b515f3d7875aa

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe
Size 1.1MB
Sample240901-xqqnjayhrk
SHA256 2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257
MD5 f00ca6c492dbbd67bdc91a5bf15fd697
SHA1 aa8244a42eb8e56dc67e0f52940d300e20b57423
SHA512 68f6bf042d9e05c1d1150f69dcfd2a989fddf1eba55d6ed40d0f2a9fb814a046f78fff45269af00f6be16a87734f330266fb40119fe641fb17c0bb366ebbadc7
SSDEEP 12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5YZ:tcykpY5852j6aJGl5cqBe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	gupyf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	rytugo.exe

Executes dropped EXE 3 IoCs

pid	Process
4580	gupyf.exe
4924	rytugo.exe
2428	dynej.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000234c9-31.dat	upx
behavioral2/memory/2428-38-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/2428-42-0x0000000000400000-0x0000000000599000-memory.dmp	upx
behavioral2/memory/2428-43-0x0000000000400000-0x0000000000599000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gupyf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rytugo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dynej.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe
2428	dynej.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4580	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	84
PID 4824 wrote to memory of 4580	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	84
PID 4824 wrote to memory of 4580	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	84
PID 4824 wrote to memory of 1720	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	86
PID 4824 wrote to memory of 1720	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	86
PID 4824 wrote to memory of 1720	4824	2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe	86
PID 4580 wrote to memory of 4924	4580	gupyf.exe	88
PID 4580 wrote to memory of 4924	4580	gupyf.exe	88
PID 4580 wrote to memory of 4924	4580	gupyf.exe	88
PID 4924 wrote to memory of 2428	4924	rytugo.exe	99
PID 4924 wrote to memory of 2428	4924	rytugo.exe	99
PID 4924 wrote to memory of 2428	4924	rytugo.exe	99
PID 4924 wrote to memory of 3396	4924	rytugo.exe	100
PID 4924 wrote to memory of 3396	4924	rytugo.exe	100
PID 4924 wrote to memory of 3396	4924	rytugo.exe	100

C:\Users\Admin\AppData\Local\Temp\2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe
"C:\Users\Admin\AppData\Local\Temp\2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\gupyf.exe
  "C:\Users\Admin\AppData\Local\Temp\gupyf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\rytugo.exe
    "C:\Users\Admin\AppData\Local\Temp\rytugo.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\dynej.exe
      "C:\Users\Admin\AppData\Local\Temp\dynej.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 340B
SHA256 0d2783682a5665d244c4acf16236bfab590d1fc61627789b50157c26a38245fe
MD5 5535a1367387b71e7d096adee89f8e71
SHA1 28e28e11b966e15e9ca02f8d1cb579fdf1187ca4
SHA512 2eefdd38b9bf2493bf48641b3ef1f146c3b16212c543ce309cd026f6a4475d95bf33135362be46bb23fa68bc911d524334f942101669263f1d959722152ee55c
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 79fbc08169c156fc3c53d72099d7a7df0f3d32b63b5e0442cec62781913c7faa
MD5 0e9fefcdfc5a2b5fd07a4d0b2bfb01af
SHA1 9ae517272f397a34ee21bb4aaa07deb5d9bfbf77
SHA512 a8b14ff8952f688eb893c8987602d37ebda27b322933e40cbd9d647929e2ea7f3b340235beb25196dec50c4924a77056e0fb25b1f69442cb2fb9e137b57ea4ac
MD5 SHA1 SHA512

Submit Download

dynej.exe

Path C:\Users\Admin\AppData\Local\Temp\dynej.exe
Size 459KB
SHA256 c510f1dec2df5b5cbe7c19c10285fd6411a2df3561f2d1538578a5c019a24162
MD5 d9411183b49b957f0b342d1035396567
SHA1 dcbd040801d6a16532496ebcec49a23b2330b15a
SHA512 5959c9fdeaacaf52f85400513a72ac888f919e902b917925f58565206e63f714f4a433f29fe6c5d535b408ad311e942340a7514943d0fe81137a8d4c27b71ebf
SSDEEP 12288:fXb1TjQ+p3rbNuqsDBFBygivAIKMV4qljNk2oSU:fXbrp3rbER9rNpIKW4qJWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a2b4e47318e7bc53060d9662b390765ee6e697479b767f153e381d538da404f8
MD5 70fc17b9fec05df6696ba5349f4facad
SHA1 7548efac8a56ab948f754c8a9dbfd8616ead1553
SHA512 f996b98b4030e2217608500144ad9d815d4ef2c301417d49f9b12aaf799b0478f8d89fdf78887768b36d2d7cf49f00771879c716df6a939e4790ef68f5e29cf8
MD5 SHA1 SHA512

Submit Download

gupyf.exe

Path C:\Users\Admin\AppData\Local\Temp\gupyf.exe
Size 1.1MB
SHA256 bcd104410567bbbf247c993766e5325544b53beb1f48955927985a7cc887d543
MD5 4845cc16b0c0c417485fdca07978c538
SHA1 cc2013f5644265f27e9224318dfa664853444d33
SHA512 9b739c6aba5bd069ed71d0e2d2a8a89b0f77beea45db18bb55c5d25320823ddec1306c625353b663d3a19a940132400ef5e271883eebe3bbead375cf856418d5
SSDEEP 12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5Ye:tcykpY5852j6aJGl5cqB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2428-42-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/2428-38-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/2428-43-0x0000000000400000-0x0000000000599000-memory.dmp

Download

memory/4580-24-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4824-15-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4924-25-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4924-39-0x0000000000400000-0x0000000000524000-memory.dmp

Download