urelas | b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3d

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
Size 331KB
Sample240929-m8f7ps1grq
SHA256 b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3d
MD5 76d7e0e4c1adf9a65b43c756597d7750
SHA1 21ae822a6a61450fc7f8c8f02f767f270b96927c
SHA512 884f80acf35191d83a7398287ccf8691fc77d52a65e8f5668c3d83becdd2bf7845a0937337d6fe586231bda7d5b5f5e7d186798aa0d0be5dc68ca2cb6441e17c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYy:vHW138/iXWlK885rKlGSekcj66ci3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
3052	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2620	nuubr.exe
2224	ofhug.exe

Loads dropped DLL 2 IoCs

pid	Process
1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
2620	nuubr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuubr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ofhug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe
2224	ofhug.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2620	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	30
PID 1760 wrote to memory of 2620	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	30
PID 1760 wrote to memory of 2620	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	30
PID 1760 wrote to memory of 2620	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	30
PID 1760 wrote to memory of 3052	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	31
PID 1760 wrote to memory of 3052	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	31
PID 1760 wrote to memory of 3052	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	31
PID 1760 wrote to memory of 3052	1760	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	31
PID 2620 wrote to memory of 2224	2620	nuubr.exe	33
PID 2620 wrote to memory of 2224	2620	nuubr.exe	33
PID 2620 wrote to memory of 2224	2620	nuubr.exe	33
PID 2620 wrote to memory of 2224	2620	nuubr.exe	33

C:\Users\Admin\AppData\Local\Temp\b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
"C:\Users\Admin\AppData\Local\Temp\b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\nuubr.exe
  "C:\Users\Admin\AppData\Local\Temp\nuubr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\ofhug.exe
    "C:\Users\Admin\AppData\Local\Temp\ofhug.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 485820e3ac3939b8dbabd20dc282d7c39fc991b50f80898d1047340004e007f0
MD5 1dd5be40b171eefcec7649c82410f61c
SHA1 535fa73a93ee53218a704e9b1e5558beb81e1ec9
SHA512 70d7fe7554cc40866a9e53444603f0ed52ec9db738d010ed03abaecd1ceaca4e5d1f1bdd7757ba0b3351c52defa22b2e4d827b2092010286d3fd9286503ac150
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 fa053fd6d3a02ae5d254766ec2b80871ebf2ac83f93b8b1ac5b4785a6f1c033d
MD5 38c408c5fe921a025dfc0cea2cc3d6ed
SHA1 c222827627d9aea6d0ea5e577e3ab7bd2e48fe60
SHA512 9e3196f01273a1892c22a6889abaaf118c27d0cf39b9875b94dc52d41291e86c8cc32d267052a5d53170378c8e1e3aab7d8a1e30084f0a8660d6a4eabde0f783
MD5 SHA1 SHA512

Submit Download

nuubr.exe

Path C:\Users\Admin\AppData\Local\Temp\nuubr.exe
Size 331KB
SHA256 c9c0a6530e5d84ed848e115cf185f07aefc3168858841a809be34974516ed660
MD5 f27fb3e4a37e4351675f0a3ba9272894
SHA1 11acc11c5e2f5b8b266547f5f52915ba4f595dfc
SHA512 a6249426967a7842b9efaa46ec36b0e2cae4ccedd44cd4654998360ebd8b54eddcea10e808647d4cf28c4f04aafcb7b812251ff7a1d392ee862a2a92e3f96e52
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYT:vHW138/iXWlK885rKlGSekcj66ciG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofhug.exe

Path \Users\Admin\AppData\Local\Temp\ofhug.exe
Size 172KB
SHA256 93662316ecb39ace0f6eef63f1a6eae1a53c624495d8e011afc1c4fa57d7f946
MD5 cdc4d970f24ac15415ced764637b3437
SHA1 bec9bebd4b691b6480ec9d464da6935109b7ad3c
SHA512 9df38cd5a41da5812555eeb464ad1100c655dffc3903a77ea40b803b4ae74b61cf8f38fcbf9590c0fe1a4767f4ec882f04c6729faf01a2395dce5e68c70dfb96
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGiff:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1760-19-0x00000000010B0000-0x0000000001131000-memory.dmp

Download

memory/1760-7-0x0000000000FF0000-0x0000000001071000-memory.dmp

Download

memory/1760-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1760-0-0x00000000010B0000-0x0000000001131000-memory.dmp

Download

memory/2224-41-0x0000000000BB0000-0x0000000000C49000-memory.dmp

Download

memory/2224-46-0x0000000000BB0000-0x0000000000C49000-memory.dmp

Download

memory/2224-45-0x0000000000BB0000-0x0000000000C49000-memory.dmp

Download

memory/2224-40-0x0000000000BB0000-0x0000000000C49000-memory.dmp

Download

memory/2620-23-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2620-38-0x00000000001F0000-0x0000000000271000-memory.dmp

Download

memory/2620-22-0x00000000001F0000-0x0000000000271000-memory.dmp

Download

memory/2620-11-0x0000000000020000-0x0000000000021000-memory.dmp

Download