urelas | 198669c4a41c684109ec19b67aa4d088b34e87fa25fc328135614e1365b6a686

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b64ed7c16caf24fa770d3bef5c3ce80N.exe
Size 328KB
Sample240910-cbst5ashmf
SHA256 198669c4a41c684109ec19b67aa4d088b34e87fa25fc328135614e1365b6a686
MD5 5b64ed7c16caf24fa770d3bef5c3ce80
SHA1 fbf7242979878dd1a1bd7c323e6a5d760981bac7
SHA512 8b5e39b573ccf9039219f5e535f1befdec0640d25ec5d32f408ea7598419f7ef1d6148b55c56e2d2ee402f408ddcf065fb07e422a1210bf1c987fff1ba259545
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYL:vHW138/iXWlK885rKlGSekcj66ciK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1928	rekid.exe
332	rozow.exe

Loads dropped DLL 2 IoCs

pid	Process
2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe
1928	rekid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rozow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b64ed7c16caf24fa770d3bef5c3ce80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rekid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe
332	rozow.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1928	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	31
PID 2332 wrote to memory of 1928	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	31
PID 2332 wrote to memory of 1928	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	31
PID 2332 wrote to memory of 1928	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	31
PID 2332 wrote to memory of 2700	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	32
PID 2332 wrote to memory of 2700	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	32
PID 2332 wrote to memory of 2700	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	32
PID 2332 wrote to memory of 2700	2332	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	32
PID 1928 wrote to memory of 332	1928	rekid.exe	34
PID 1928 wrote to memory of 332	1928	rekid.exe	34
PID 1928 wrote to memory of 332	1928	rekid.exe	34
PID 1928 wrote to memory of 332	1928	rekid.exe	34

C:\Users\Admin\AppData\Local\Temp\5b64ed7c16caf24fa770d3bef5c3ce80N.exe
"C:\Users\Admin\AppData\Local\Temp\5b64ed7c16caf24fa770d3bef5c3ce80N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\rekid.exe
  "C:\Users\Admin\AppData\Local\Temp\rekid.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\rozow.exe
    "C:\Users\Admin\AppData\Local\Temp\rozow.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 05e9b607cb45e61f4a121463dd97902a1051400cb341509dfdf02b0050b98d94
MD5 1309211d3c6fc333d576193174776282
SHA1 d90ad3bd60242048e8147cd4cc24c085cbf67528
SHA512 ea5fd77e51429712af1abf3b80874f9fac75b088a6de81745a1303b202e347ced9f195ffbfc4372433f1b8d979f92f5db2e5f227e7acba8edef3f5afe332b6e8
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5055df9477c7b72160572dc8ec988217d579479f453cc6185727e8c27dc7f43f
MD5 35df79aa13aea1b9faac5a4ab11f8e83
SHA1 78b13bf7f58538d45a7476d06c2cfebf31b070fc
SHA512 c4489264f22cddc68e96a7a2ec2349df9390ed4dc1a02ba025d5566d3b34161d543f7f08f04d83b45ad183c7926539b40f3a0d70b2c93341e34cb61a1c0cb5bb
MD5 SHA1 SHA512

Submit Download

rekid.exe

Path \Users\Admin\AppData\Local\Temp\rekid.exe
Size 328KB
SHA256 ee8f446b616e2a5beecaf2a075c3749ea217ecfce6bf1bb719f623bfd800d4d6
MD5 2d8be935a6720c81c708e41af7963f37
SHA1 d99fd20dda73778fd257f9dab548fa0c3f627585
SHA512 605bf8b8cbafc482f34b0e8af4d34e07973890d5d35b991e04514224eef4dd829a9d8e8c0e723e56d8e973eb9cc08f91a731fc666ac87bbf133a63796c521cb3
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYp:vHW138/iXWlK885rKlGSekcj66cio
MD5 SHA1 SHA512 SSDEEP

Submit Download

rozow.exe

Path \Users\Admin\AppData\Local\Temp\rozow.exe
Size 172KB
SHA256 26b804ae191684484a20da9210917ea150300a6c75f63bf5f148d483d95c08ed
MD5 1fe98bb230dbcce6ea2d9ac5dd7444a6
SHA1 b830274846be6471517ff0701097285c48f11af2
SHA512 319ad2907c1118cc2b03f5e61e3ec2d8d674daaf537292a8e74c4ee5ba3def826bc6be4d1cda63da691458eca86a5b506da645e486b40ab073574c8b6ae5151c
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifO:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/332-41-0x00000000008E0000-0x0000000000979000-memory.dmp

Download

memory/332-44-0x00000000008E0000-0x0000000000979000-memory.dmp

Download

memory/332-46-0x00000000008E0000-0x0000000000979000-memory.dmp

Download

memory/332-47-0x00000000008E0000-0x0000000000979000-memory.dmp

Download

memory/1928-11-0x0000000000AA0000-0x0000000000B21000-memory.dmp

Download

memory/1928-12-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1928-24-0x0000000000AA0000-0x0000000000B21000-memory.dmp

Download

memory/1928-40-0x0000000000AA0000-0x0000000000B21000-memory.dmp

Download

memory/2332-10-0x0000000001F10000-0x0000000001F91000-memory.dmp

Download

memory/2332-21-0x0000000000A00000-0x0000000000A81000-memory.dmp

Download

memory/2332-0-0x0000000000A00000-0x0000000000A81000-memory.dmp

Download

memory/2332-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download