urelas | 4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe
Size 324KB
Sample240926-c8631swdma
SHA256 4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5
MD5 ac2d561a7739ff2025d2421536efe200
SHA1 bdb179fc9dd121c5720eff708648a685f847c3cb
SHA512 c59da84689ef9dfbc373d2d6cece08fb1b391768b4a106378bde11f75514e8f8aa17ffdaab32dbc4e9e1a3c8d31654f2df65df87f9d11a2b47ac347b9d2294b0
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMA:vHW138/iXWlK885rKlGSekcj66cik
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	kufas.exe

Executes dropped EXE 2 IoCs

pid	Process
3216	kufas.exe
2992	yhiwf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhiwf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kufas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe
2992	yhiwf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3216	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	82
PID 4496 wrote to memory of 3216	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	82
PID 4496 wrote to memory of 3216	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	82
PID 4496 wrote to memory of 668	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	83
PID 4496 wrote to memory of 668	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	83
PID 4496 wrote to memory of 668	4496	4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe	83
PID 3216 wrote to memory of 2992	3216	kufas.exe	94
PID 3216 wrote to memory of 2992	3216	kufas.exe	94
PID 3216 wrote to memory of 2992	3216	kufas.exe	94

C:\Users\Admin\AppData\Local\Temp\4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe
"C:\Users\Admin\AppData\Local\Temp\4e9cb23c800530d8c758874c3d796446939d9ea7a43365cee5674e3f7d89b6e5N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\kufas.exe
  "C:\Users\Admin\AppData\Local\Temp\kufas.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\yhiwf.exe
    "C:\Users\Admin\AppData\Local\Temp\yhiwf.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 3978ae300bfee929da000d706cb5ea0e4342b309c2af146698f37848ed2468cf
MD5 88bc5c0144ebd6cb042177bd4f265e65
SHA1 24be11c6afa1043c0340ddc93ee94433c2330d12
SHA512 da833732b950bb183c9e0d7383cdd0b817facde6cb72f56abda25449cca27c1d3cd173d296b33bfdc94cfbae75dfe64024b4bac27c583bb9b06316ae08d931e6
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 072b8e677c16a60e51bfe7cf060f4550d0485c3fd2b6b261fbd9a8ff65570e29
MD5 7656b0eaf468bb7b5221d8c402bfa60c
SHA1 acc1211476379b38eb35514950f4913aecf66e30
SHA512 86d9c857e45fd10dd321b95b99dbf09c6bd208ed05aa1a3c9fd6bfb5c4810f3b9d57fc1cc2aa310f54db1fdb71a63fa20a74d9cac8e2e205652a608d73ed54e4
MD5 SHA1 SHA512

Submit Download

kufas.exe

Path C:\Users\Admin\AppData\Local\Temp\kufas.exe
Size 324KB
SHA256 75c749215fb5810797330776bfd64420fe36de9e3b4435975b520c2b079477fe
MD5 54550fb57da6451c6425d1fa434ca145
SHA1 9eec1221806ead54b59edb88b16c271afd08b500
SHA512 0d5f0e112e72a31f720c1577a6d4f0a1b4d1b16cb78b2107799b5c08cda3ca3d2a1429d8823cdee82ceed6fd8768ce7ade94dd6d997ea5c80a4803a38befd13f
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMj:vHW138/iXWlK885rKlGSekcj66ci3
MD5 SHA1 SHA512 SSDEEP

Submit Download

yhiwf.exe

Path C:\Users\Admin\AppData\Local\Temp\yhiwf.exe
Size 172KB
SHA256 c34b4fc805f8555cf5b8cd2d4e0b4dcddc8cd8f87888179bf1a1fa9d794219a9
MD5 2fe04cb806ff69ca510d85a87129c04f
SHA1 b0d292ee9ac450e793cd6b754da5ad0433dda1bf
SHA512 86559ed1dc92adeb81497c6067eb780f1cc2baa743cf9104658a45afef7f74eafe951171411d6dcf48ab603dcbf05ee40073ea83285bc5846783be0a49050a3e
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifO:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2992-40-0x0000000000490000-0x0000000000529000-memory.dmp

Download

memory/2992-47-0x0000000000490000-0x0000000000529000-memory.dmp

Download

memory/2992-46-0x0000000000490000-0x0000000000529000-memory.dmp

Download

memory/2992-45-0x0000000000B70000-0x0000000000B72000-memory.dmp

Download

memory/2992-41-0x0000000000490000-0x0000000000529000-memory.dmp

Download

memory/2992-39-0x0000000000B70000-0x0000000000B72000-memory.dmp

Download

memory/3216-20-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Download

memory/3216-38-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Download

memory/3216-14-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Download

memory/3216-11-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Download

memory/4496-0-0x00000000006F0000-0x0000000000771000-memory.dmp

Download

memory/4496-17-0x00000000006F0000-0x0000000000771000-memory.dmp

Download

memory/4496-1-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download