urelas | d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe
Size 326KB
Sample240925-ytsgzaverj
SHA256 d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768
MD5 7eafbe744dcd47ba348f54bc9bfd3c60
SHA1 b05315bc92a2d8f337fa9e7b4e835e25f161d101
SHA512 f7bf9044324fdf41bf9ec8aecc55780c0e4f5c8eabae3d94ee2c19d3ed5b96a9695aafc8aa7fcd21722fe28f1b1359646b3e75c0f471cc49b10ded6822f7a7ca
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVl:vHW138/iXWlK885rKlGSekcj66ciEl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	gejuy.exe

Executes dropped EXE 2 IoCs

pid	Process
2456	gejuy.exe
3176	xaopl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gejuy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xaopl.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe
3176	xaopl.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2456	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	82
PID 3624 wrote to memory of 2456	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	82
PID 3624 wrote to memory of 2456	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	82
PID 3624 wrote to memory of 912	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	83
PID 3624 wrote to memory of 912	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	83
PID 3624 wrote to memory of 912	3624	d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe	83
PID 2456 wrote to memory of 3176	2456	gejuy.exe	94
PID 2456 wrote to memory of 3176	2456	gejuy.exe	94
PID 2456 wrote to memory of 3176	2456	gejuy.exe	94

C:\Users\Admin\AppData\Local\Temp\d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe
"C:\Users\Admin\AppData\Local\Temp\d1d0e715e2cd1ddbe763559394f3075ee101bdde0fcc19bad4d495a8878df768N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\gejuy.exe
  "C:\Users\Admin\AppData\Local\Temp\gejuy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\xaopl.exe
    "C:\Users\Admin\AppData\Local\Temp\xaopl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 d66a0a0fced1aba0cbdf710536e1ae05a715e2a49accb1f31bbb7fde1c2b00a5
MD5 037d0d3383207c5d19fca4f4889ee2aa
SHA1 262bf4195c7e0c7874091a43fdf18766d083cc5e
SHA512 2f334c1f2ef0190d8813da5e683a94b16a61584ce48382fe9b7f122a070478bbc9d61c743e964478e5424bdbdeba8df59e022b66b1c4ba93e30564f87cdb9db8
MD5 SHA1 SHA512

Submit Download

gejuy.exe

Path C:\Users\Admin\AppData\Local\Temp\gejuy.exe
Size 327KB
SHA256 5b659287da749824295e595bdf6f33490f3489e6633e26196f2b0292e4eff3a0
MD5 0a6904e1cb847c06d2b261c3f61720f8
SHA1 6befea871776af51f37c3a98e55e1fdfa4c875cb
SHA512 cf585acf31a0a32ac795d5fdbfdd99f351a45b38b8b98ac7fb16a49f39ef82f0ca3c3c00b418b1253c78ffd1f9070cf5b5e68eb63333b94a8f30cd7e7d3266e6
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVH:vHW138/iXWlK885rKlGSekcj66ciEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f989d19387c29e150a3996e51414da614b494020075432262933802d3df37d83
MD5 3bd2654c702dd084522345aaa01645ca
SHA1 4fdd67b0866524187c7d42ef8d32b83e7cb2592e
SHA512 8dba24652ff9cb30dba8bb2fb637369c904ddea3e31e4ee1757cfa885401ade719a739716c9aaa4639dac40479ad89c89a024caba26b279714cbc7913127c230
MD5 SHA1 SHA512

Submit Download

xaopl.exe

Path C:\Users\Admin\AppData\Local\Temp\xaopl.exe
Size 172KB
SHA256 8f025bb2987d9e0ef564f505223cb73ac7de5dac98becd68cec6a31249da7192
MD5 782b9668efdf54e1e3f8234d0b15cb7d
SHA1 8b3d8a9a3f430c07d2b7f7aa458ca247777ed69c
SHA512 034d7c1885c0ed7ef24d87f83c6f9441ff20b2dafea8d52b51e855b81023484163ca33d9cd715a195b8bbcb686e4fa85a049cc0b9a23295dc800821f4c2bb400
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifn:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2456-20-0x0000000000B90000-0x0000000000C11000-memory.dmp

Download

memory/2456-13-0x0000000000B90000-0x0000000000C11000-memory.dmp

Download

memory/2456-14-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/2456-43-0x0000000000B90000-0x0000000000C11000-memory.dmp

Download

memory/3176-38-0x0000000000D80000-0x0000000000D82000-memory.dmp

Download

memory/3176-39-0x0000000000750000-0x00000000007E9000-memory.dmp

Download

memory/3176-37-0x0000000000750000-0x00000000007E9000-memory.dmp

Download

memory/3176-45-0x0000000000D80000-0x0000000000D82000-memory.dmp

Download

memory/3176-46-0x0000000000750000-0x00000000007E9000-memory.dmp

Download

memory/3176-47-0x0000000000750000-0x00000000007E9000-memory.dmp

Download

memory/3624-17-0x0000000000240000-0x00000000002C1000-memory.dmp

Download

memory/3624-0-0x0000000000240000-0x00000000002C1000-memory.dmp

Download

memory/3624-1-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download