urelas | 198669c4a41c684109ec19b67aa4d088b34e87fa25fc328135614e1365b6a686

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b64ed7c16caf24fa770d3bef5c3ce80N.exe
Size 328KB
Sample240910-cbst5ashmf
SHA256 198669c4a41c684109ec19b67aa4d088b34e87fa25fc328135614e1365b6a686
MD5 5b64ed7c16caf24fa770d3bef5c3ce80
SHA1 fbf7242979878dd1a1bd7c323e6a5d760981bac7
SHA512 8b5e39b573ccf9039219f5e535f1befdec0640d25ec5d32f408ea7598419f7ef1d6148b55c56e2d2ee402f408ddcf065fb07e422a1210bf1c987fff1ba259545
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYL:vHW138/iXWlK885rKlGSekcj66ciK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	5b64ed7c16caf24fa770d3bef5c3ce80N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	jisee.exe

Executes dropped EXE 2 IoCs

pid	Process
532	jisee.exe
4816	zayvg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zayvg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b64ed7c16caf24fa770d3bef5c3ce80N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jisee.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe
4816	zayvg.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 532	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	87
PID 2712 wrote to memory of 532	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	87
PID 2712 wrote to memory of 532	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	87
PID 2712 wrote to memory of 4612	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	88
PID 2712 wrote to memory of 4612	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	88
PID 2712 wrote to memory of 4612	2712	5b64ed7c16caf24fa770d3bef5c3ce80N.exe	88
PID 532 wrote to memory of 4816	532	jisee.exe	99
PID 532 wrote to memory of 4816	532	jisee.exe	99
PID 532 wrote to memory of 4816	532	jisee.exe	99

C:\Users\Admin\AppData\Local\Temp\5b64ed7c16caf24fa770d3bef5c3ce80N.exe
"C:\Users\Admin\AppData\Local\Temp\5b64ed7c16caf24fa770d3bef5c3ce80N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\jisee.exe
  "C:\Users\Admin\AppData\Local\Temp\jisee.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\zayvg.exe
    "C:\Users\Admin\AppData\Local\Temp\zayvg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 278B
SHA256 05e9b607cb45e61f4a121463dd97902a1051400cb341509dfdf02b0050b98d94
MD5 1309211d3c6fc333d576193174776282
SHA1 d90ad3bd60242048e8147cd4cc24c085cbf67528
SHA512 ea5fd77e51429712af1abf3b80874f9fac75b088a6de81745a1303b202e347ced9f195ffbfc4372433f1b8d979f92f5db2e5f227e7acba8edef3f5afe332b6e8
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ef7ec6866a29f8b36a946f23706ac157624f1d6516f72f621ed37a2949e4b094
MD5 a8700075bc849c8e9dee97137f6e89de
SHA1 3d34e262445673a6df6c2234fb12e8651f8e5524
SHA512 cfcf0948ebf92e61598436338b2d24d7dc87ea4cb82832e06bdd763017bb0458362ecfad466b49dc26d3086f6f731bcd0850576a75f748246301abc5a6cf71e8
MD5 SHA1 SHA512

Submit Download

jisee.exe

Path C:\Users\Admin\AppData\Local\Temp\jisee.exe
Size 328KB
SHA256 b00fe74c629d1383d808a6c5dbb44ee7e23262e4e3037152b9970df236112afc
MD5 309c8c36fc9088ea850468ad0986602e
SHA1 ff244c1e6f855bb72417ec8975726d49a4a1fe98
SHA512 40cd829bd264bdcaaa0d601e44ca76c7dc3f48c521f12af4110e7e25b7df0041db50cc1029582018010793c8a1a87f039e9692978670c0ce17136402fe12a89a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYa:vHW138/iXWlK885rKlGSekcj66cif
MD5 SHA1 SHA512 SSDEEP

Submit Download

zayvg.exe

Path C:\Users\Admin\AppData\Local\Temp\zayvg.exe
Size 172KB
SHA256 a8d9e9c5ce3e79e6fdae3ce4b488c3aec70a2eb6c688270d04adcb99eb198f24
MD5 b9d9fab9a0bbb811e26a2d387bc2aae9
SHA1 9d3de320d7e4f4a43a4a35d9efe73a1ef53b715b
SHA512 f9c0170bd95873f7acf79d529f4d7746e9d89e6e6c30493ae1aa2008e9edbaf6a3c6cb111ee1313c7e84c2b3be0c0b59dfe4a93cac2fec87f4a90e2b54ca474f
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGiff:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-19-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/532-20-0x0000000000220000-0x00000000002A1000-memory.dmp

Download

memory/532-12-0x0000000000220000-0x00000000002A1000-memory.dmp

Download

memory/532-13-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/532-43-0x0000000000220000-0x00000000002A1000-memory.dmp

Download

memory/2712-0-0x00000000009C0000-0x0000000000A41000-memory.dmp

Download

memory/2712-1-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/2712-16-0x00000000009C0000-0x0000000000A41000-memory.dmp

Download

memory/4816-37-0x0000000000C50000-0x0000000000CE9000-memory.dmp

Download

memory/4816-39-0x0000000000C50000-0x0000000000CE9000-memory.dmp

Download

memory/4816-38-0x00000000007D0000-0x00000000007D2000-memory.dmp

Download

memory/4816-46-0x00000000007D0000-0x00000000007D2000-memory.dmp

Download

memory/4816-45-0x0000000000C50000-0x0000000000CE9000-memory.dmp

Download

memory/4816-47-0x0000000000C50000-0x0000000000CE9000-memory.dmp

Download