urelas | 0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe
Size 329KB
Sample240925-xcwbvs1dln
SHA256 0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2
MD5 22df7d1773da9369ff87f5a269b2949d
SHA1 80396f4872f828ce3a120cd1ea3f167cc4392557
SHA512 01171d4cc929053c7c2904e963925bbb98290f535976ed690af10432c86611d4f38095b8540a46f3278122e74956e06c9c28755edbd494ae6ab7ba30b59a6453
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYn:vHW138/iXWlK885rKlGSekcj66cii
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	ykikx.exe

Executes dropped EXE 2 IoCs

pid	Process
4808	ykikx.exe
4148	agwej.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ykikx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agwej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe
4148	agwej.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4808	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	82
PID 4220 wrote to memory of 4808	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	82
PID 4220 wrote to memory of 4808	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	82
PID 4220 wrote to memory of 4804	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	83
PID 4220 wrote to memory of 4804	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	83
PID 4220 wrote to memory of 4804	4220	0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe	83
PID 4808 wrote to memory of 4148	4808	ykikx.exe	94
PID 4808 wrote to memory of 4148	4808	ykikx.exe	94
PID 4808 wrote to memory of 4148	4808	ykikx.exe	94

C:\Users\Admin\AppData\Local\Temp\0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe
"C:\Users\Admin\AppData\Local\Temp\0fdfa49759b6d30a1c880c978ef52f5521b4414a844e600c69741acaaa5acca2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\ykikx.exe
  "C:\Users\Admin\AppData\Local\Temp\ykikx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\agwej.exe
    "C:\Users\Admin\AppData\Local\Temp\agwej.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 ae7742afe3cdbed6bfa74e79545e8659cbb099788b9f5fc2bc5e47ebdb339c92
MD5 b65373e88eff92da626197748fa15be5
SHA1 71ecbdfa4c5afd85e021718e88b96b52616c3bf1
SHA512 34dd33556387df979f9390406bf5067967be2b5820bffacda27da1a5dbfe13fce5a1d6f32006bb2615c4fb62fe8c8a46946b25136adfdb4906ab1b2a42166e3c
MD5 SHA1 SHA512

Submit Download

agwej.exe

Path C:\Users\Admin\AppData\Local\Temp\agwej.exe
Size 172KB
SHA256 d73cf064b914d4ec4e5a3269509aa053cc1fec1d5d8e2b9dccf0259680798c5c
MD5 329c9d064f7ba5c6b8a781701e18a0a0
SHA1 cffc392c3ac0c131b0c7cadd7ea141c6c286c985
SHA512 60e7d778274ef4dfcc774917a411339441952d888738461375c224db4d8d6cdc16870e9db0b37dba1c6fc21f91bc17bbc3c5c47b6329029e51b170e05b89523b
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifY:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f0bea8badc6411c9238a4a6b68d9ee1ba4bde83888a8d3eb7d139bbf4fb9bed1
MD5 43e07b70c0296014bcb8755c94f4033c
SHA1 99d5ed4a066595d385f31a942cfdbe2972c94b20
SHA512 00b0090bbf8f5498a032dcaa0a455c35d2267d447751f6ef957f3696c252915ff00d7a3764b4df6965f45e4cb27d6be56a8ae44cc229f28a4d5253c0df56e7a8
MD5 SHA1 SHA512

Submit Download

ykikx.exe

Path C:\Users\Admin\AppData\Local\Temp\ykikx.exe
Size 329KB
SHA256 b0839dc2493feb059f01b5fa7096868a80608f37c8a9dbae94666e7a4a5f9857
MD5 9f7b615cda213f6e5dff90988e0c89e5
SHA1 9edbc5909e7e0b6b88ea95c6b99ceaabf4e08ddc
SHA512 d32a852d8441c0ad12fcc42d44b5011219d29524bf2fce4e141c38072e5592da064c1de1d2d8fce18887de4faa297d6d7e7fd8a28b311145fe3eef2734fcbe1a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYI:vHW138/iXWlK885rKlGSekcj66ci1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4148-46-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-50-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-49-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-48-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-47-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-40-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4148-44-0x0000000000B90000-0x0000000000B92000-memory.dmp

Download

memory/4148-43-0x0000000000FF0000-0x0000000001089000-memory.dmp

Download

memory/4220-0-0x0000000000AA0000-0x0000000000B21000-memory.dmp

Download

memory/4220-17-0x0000000000AA0000-0x0000000000B21000-memory.dmp

Download

memory/4220-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/4808-21-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/4808-39-0x0000000000F60000-0x0000000000FE1000-memory.dmp

Download

memory/4808-20-0x0000000000F60000-0x0000000000FE1000-memory.dmp

Download

memory/4808-11-0x0000000000F60000-0x0000000000FE1000-memory.dmp

Download

memory/4808-14-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download