urelas | eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2024, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe
Size 328KB
Sample240917-hm8bvazcpd
SHA256 eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78
MD5 315e8b6d8cd5d0f254dd4a8bf90b9cb0
SHA1 1e6fce16ca1a27d2e75fcc223aed56b4d3b99dd5
SHA512 a44e4cc57fc60dcb02c028c3c3f79a87f5897887d6b01f615b7864c1d894a98951f9b1f572ad342d8c070b1b5d3f5a15ffa4c131e24bc5b2c1a34f53a6a9bb09
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYy:vHW138/iXWlK885rKlGSekcj66ci/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	xybup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe

Executes dropped EXE 2 IoCs

pid	Process
400	xybup.exe
2796	tizyu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xybup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tizyu.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe
2796	tizyu.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 400	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	84
PID 3668 wrote to memory of 400	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	84
PID 3668 wrote to memory of 400	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	84
PID 3668 wrote to memory of 2624	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	85
PID 3668 wrote to memory of 2624	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	85
PID 3668 wrote to memory of 2624	3668	eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe	85
PID 400 wrote to memory of 2796	400	xybup.exe	94
PID 400 wrote to memory of 2796	400	xybup.exe	94
PID 400 wrote to memory of 2796	400	xybup.exe	94

C:\Users\Admin\AppData\Local\Temp\eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe
"C:\Users\Admin\AppData\Local\Temp\eefe119e266f5178ae2b83b7185f2410be13fe6d824470eb196d0e2b40579f78N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\xybup.exe
  "C:\Users\Admin\AppData\Local\Temp\xybup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\tizyu.exe
    "C:\Users\Admin\AppData\Local\Temp\tizyu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 792d18cfcfc3de835fe581550d8b5331c186ebfdc5e4d098fae47ed7f52c7e6f
MD5 5cd72ab40e08fc3fc624f645752598c0
SHA1 2360d37be354cf3bc021879e8d7d96fe2fc6fb1c
SHA512 a8b1ab814b05cbe314e75ccfc3abd51307f0b01bd26ffa05634e46f36b3dcc06eed104229f74d94dc3dbfeacfca5842ac210950a366938b9168ea285059c6721
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 7458586ffea73a81a4f7cf432fec7fd6877bda2a35a46408343b4037c1b6fd8c
MD5 64970508f753231db5790ff57c9ee25c
SHA1 2ac13c07de0b00283f58f650f4a24228a0d239bf
SHA512 530979ef607e0b95ffc8a908f2b51b12f8e38c7935bab4f6dd53fcb07b89144347224c4c38d0f1383d394df57dc807d1a9de030e31124aaa79612567c01a404d
MD5 SHA1 SHA512

Submit Download

tizyu.exe

Path C:\Users\Admin\AppData\Local\Temp\tizyu.exe
Size 172KB
SHA256 b4a3e0c8e6904aab9ffe322403672be6171aedc6e020c75d2994994eef1ffc56
MD5 59221c7a7a4b3ae1b50f476c285f75a5
SHA1 f0d37a78e4ac5fb3dcf2e22416e7ac05ff619521
SHA512 d51f8b8516e1ea849bb68de854561b66f5c8d16055409011b78b60d96b64be97a987f959f6b881551475fbc985bc90977dade8dd46c1a4f21a2517c3f04276bc
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif5:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

xybup.exe

Path C:\Users\Admin\AppData\Local\Temp\xybup.exe
Size 328KB
SHA256 10bba20cb2787c552a9c23ac10eb3c8450deec19742737a39205bf70697d7197
MD5 1e2aa810cf7080b25013f37a46f2e6df
SHA1 d692f7f8c25a1ff0c77287243b373186e8f3b15e
SHA512 4c4239390155d68720ae88e344d73be82c0c65bb2aa3e18dd008a8aebb4b00a5a5c27e1bedc189e02699d397f22e4596b99a84a85d0710ff88cf942bcad19201
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYs:vHW138/iXWlK885rKlGSekcj66ci9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-20-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/400-13-0x00000000006D0000-0x0000000000751000-memory.dmp

Download

memory/400-14-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/400-21-0x00000000006D0000-0x0000000000751000-memory.dmp

Download

memory/400-40-0x00000000006D0000-0x0000000000751000-memory.dmp

Download

memory/2796-38-0x0000000000550000-0x00000000005E9000-memory.dmp

Download

memory/2796-41-0x0000000000550000-0x00000000005E9000-memory.dmp

Download

memory/2796-44-0x0000000000940000-0x0000000000942000-memory.dmp

Download

memory/2796-46-0x0000000000550000-0x00000000005E9000-memory.dmp

Download

memory/2796-47-0x0000000000550000-0x00000000005E9000-memory.dmp

Download

memory/3668-17-0x0000000000670000-0x00000000006F1000-memory.dmp

Download

memory/3668-0-0x0000000000670000-0x00000000006F1000-memory.dmp

Download

memory/3668-1-0x0000000000620000-0x0000000000621000-memory.dmp

Download