urelas | 245d2f8fbe2bc2a2e3bb7d50d35c7b726e19394316aaead2902137a49e1cdcc2

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c36ddbb313c7c97a5532d1376bf814a0N.exe
Size 323KB
Sample240903-b619bavejd
SHA256 245d2f8fbe2bc2a2e3bb7d50d35c7b726e19394316aaead2902137a49e1cdcc2
MD5 c36ddbb313c7c97a5532d1376bf814a0
SHA1 a391daeebb1b1c13b51e4704b862c2e90e888344
SHA512 569814de84c4b4e17633e4046a88039175030d7e14b46d2ffb60d3d639da5900855fc8caeec5270edfe354b2ed2b6e90d4d63a25234ae5543a852d95346e4180
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYt:vHW138/iXWlK885rKlGSekcj66cig
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	c36ddbb313c7c97a5532d1376bf814a0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	qeetz.exe

Executes dropped EXE 2 IoCs

pid	Process
3256	qeetz.exe
464	vuepx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vuepx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c36ddbb313c7c97a5532d1376bf814a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qeetz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe
464	vuepx.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3256	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	87
PID 560 wrote to memory of 3256	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	87
PID 560 wrote to memory of 3256	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	87
PID 560 wrote to memory of 1852	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	88
PID 560 wrote to memory of 1852	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	88
PID 560 wrote to memory of 1852	560	c36ddbb313c7c97a5532d1376bf814a0N.exe	88
PID 3256 wrote to memory of 464	3256	qeetz.exe	99
PID 3256 wrote to memory of 464	3256	qeetz.exe	99
PID 3256 wrote to memory of 464	3256	qeetz.exe	99

C:\Users\Admin\AppData\Local\Temp\c36ddbb313c7c97a5532d1376bf814a0N.exe
"C:\Users\Admin\AppData\Local\Temp\c36ddbb313c7c97a5532d1376bf814a0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\qeetz.exe
  "C:\Users\Admin\AppData\Local\Temp\qeetz.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\vuepx.exe
    "C:\Users\Admin\AppData\Local\Temp\vuepx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 c317f7196a707ebe3c5b99a3db8f3151688ed4a0980e6135aa7b40c9f6075210
MD5 a28049197ed9565caaf48a66034368c8
SHA1 c200d5693d45dea39d5d6e031b6e5c5f364d6b9b
SHA512 e03ed60c98ed9625174b0cb176a0ce4ac5653edbe2595d657b3ccba9d8cb15f38f93e52367aab10648a5e3b2ec7444a586dc41f60db5dc1850eae7401e7ad41e
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3fff5eaebe227b010c7ffc3b79c4d824686a90a5c59ff523a522f8f57015bcca
MD5 f5c06578851a2bfeea67de6987b92091
SHA1 06fcf4e26e41c9f61711159454827668ff898acd
SHA512 2554196c8be1aaef1fe67448bde4590aafd4d159063e52637d4d7b177a68736ae46981c4aef5fb7629e89a0190e3275b3df2b2211794bd899f324da157ed5ebc
MD5 SHA1 SHA512

Submit Download

qeetz.exe

Path C:\Users\Admin\AppData\Local\Temp\qeetz.exe
Size 323KB
SHA256 e0eeec7e14d1d3025ffb946ddc0c0646dcd62763894fdb15d2856220ece66c7e
MD5 360ae986f9017c5bd0e6a075b95f0c35
SHA1 338049b03082bcc35337850bd7eb3526158c758f
SHA512 547c5a6fabe4ece661bb6ff2dfaa3d048e50f5567cac003d0f2fdce8db03fa73b3556ac74d325f380bf7f2a9e08a68d748533a2d5f286f7732001e84b96e3bac
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYbl:vHW138/iXWlK885rKlGSekcj66ciU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuepx.exe

Path C:\Users\Admin\AppData\Local\Temp\vuepx.exe
Size 172KB
SHA256 30ba391e394857bdc5f32f82c3471ec07da752e0262d9045cb1629066bf683cf
MD5 42aaec26cbb30a84f1306dfc779d32f1
SHA1 90027d9a94150f77ff0c4092587c0824dcbf6ff0
SHA512 ff43f2bbd52bff1461b378f2ea68ad2ceffb825242723beb0cff025ef45c30e1d1a97f37e03e173c2b36269a792a7c83441be1d398044b3e49880666de138a1d
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifF:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-42-0x0000000000B90000-0x0000000000B92000-memory.dmp

Download

memory/464-47-0x0000000000F00000-0x0000000000F99000-memory.dmp

Download

memory/464-46-0x0000000000F00000-0x0000000000F99000-memory.dmp

Download

memory/464-40-0x0000000000F00000-0x0000000000F99000-memory.dmp

Download

memory/464-39-0x0000000000F00000-0x0000000000F99000-memory.dmp

Download

memory/560-1-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/560-0-0x00000000000A0000-0x0000000000121000-memory.dmp

Download

memory/560-17-0x00000000000A0000-0x0000000000121000-memory.dmp

Download

memory/3256-13-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Download

memory/3256-21-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Download

memory/3256-44-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Download

memory/3256-20-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/3256-14-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download