urelas | d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aa

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe
Size 327KB
Sample240925-2fqb8svbpd
SHA256 d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aa
MD5 c52146ca69b0d8000e6034b10eb44000
SHA1 5992c2c65a25e9187c811cd5c8a18619df52318c
SHA512 14053e4edd1a38146f7dbbba72ecbc942963526a028d71643b7218ce43f5bb1363c860aa243719d52f2b1e2f4b2c7add148d153885ec5bce7017461dc5756cf2
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYlV:vHW138/iXWlK885rKlGSekcj66cii
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	igdue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe

Executes dropped EXE 2 IoCs

pid	Process
4464	igdue.exe
3300	epkub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	epkub.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe
3300	epkub.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4464	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	82
PID 2012 wrote to memory of 4464	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	82
PID 2012 wrote to memory of 4464	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	82
PID 2012 wrote to memory of 5032	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	83
PID 2012 wrote to memory of 5032	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	83
PID 2012 wrote to memory of 5032	2012	d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe	83
PID 4464 wrote to memory of 3300	4464	igdue.exe	94
PID 4464 wrote to memory of 3300	4464	igdue.exe	94
PID 4464 wrote to memory of 3300	4464	igdue.exe	94

C:\Users\Admin\AppData\Local\Temp\d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe
"C:\Users\Admin\AppData\Local\Temp\d9bd7fa6966a25fa8557d97e945f34b5f63e4d36727171ddb4fc7b0be7abc9aaN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\igdue.exe
  "C:\Users\Admin\AppData\Local\Temp\igdue.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\Admin\AppData\Local\Temp\epkub.exe
    "C:\Users\Admin\AppData\Local\Temp\epkub.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 47f7f3c9e5ef622e611c930dbd36c9a1090c37386daeaaf429f8645e9596b6a0
MD5 c374276fc60fe6d5b0ef112ab860e205
SHA1 6b0f9f9d0ab17d7a359502709d2b264bb90aebdd
SHA512 a55923761839a98e756c387cfb7927426d793170a23f8d188406592f2916f0429fd929904317ff00f964a87a964a08763a444ae98752e68cb19b28dec211b5eb
MD5 SHA1 SHA512

Submit Download

epkub.exe

Path C:\Users\Admin\AppData\Local\Temp\epkub.exe
Size 172KB
SHA256 3b0b0d6957dfcc88bebd8ca17082f8a6a313f260a418bbd90cd6543027c523a8
MD5 78e7bafad7cb6bcbbd3a0d6734b7b676
SHA1 63e1928f9a0dbf34ef33dc6a7a327d8ba0365cfe
SHA512 13c05c6672915943335d6b84f7b95da0f57dfd0ca51dbd39357836a6d4d73e83de233169609afa4407f7287b9d6e12752f4d73a1499165ce18becfd4915e9355
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifw:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 dff0b0595326a585b4c86c6d31303f49c0940f475950358e6760f43001ce96a1
MD5 f9870a531c9931859514ebb9b91918e2
SHA1 5808d18c7fcb3a6c9142a857951398008c29af65
SHA512 2d7e14ece477e5f2ed9122d37e605d62632c22c0dec89f1a2b92ef5307d70ecbc45d717749a34616159a9c5f5aea6169da0dcd5b5458420357c9434392e20d99
MD5 SHA1 SHA512

Submit Download

igdue.exe

Path C:\Users\Admin\AppData\Local\Temp\igdue.exe
Size 327KB
SHA256 24354b88f0c940e3559d36ac7d5428084bc96e689b8cc3a49f3f92a29a07b176
MD5 8858f595593c3264a3973e38ea200e34
SHA1 5fa6be591130d0880ef17408197c6f416d4f4ae6
SHA512 835eaac20051c52372fb51a4ed200bb49a80802eba5c13df673b7f60901b1dccc16c6665d76891b6de298c8e7f7c9da33025aa6cb517bbd2424f7ff002ed835a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYlO:vHW138/iXWlK885rKlGSekcj66cid
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-1-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/2012-0-0x0000000000E30000-0x0000000000EB1000-memory.dmp

Download

memory/2012-17-0x0000000000E30000-0x0000000000EB1000-memory.dmp

Download

memory/3300-38-0x0000000000B60000-0x0000000000BF9000-memory.dmp

Download

memory/3300-46-0x0000000000B60000-0x0000000000BF9000-memory.dmp

Download

memory/3300-45-0x0000000000B60000-0x0000000000BF9000-memory.dmp

Download

memory/3300-39-0x00000000007D0000-0x00000000007D2000-memory.dmp

Download

memory/3300-37-0x0000000000B60000-0x0000000000BF9000-memory.dmp

Download

memory/4464-14-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/4464-43-0x0000000000DA0000-0x0000000000E21000-memory.dmp

Download

memory/4464-20-0x0000000000DA0000-0x0000000000E21000-memory.dmp

Download

memory/4464-11-0x0000000000DA0000-0x0000000000E21000-memory.dmp

Download