urelas | b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3d

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
Size 331KB
Sample240929-m8f7ps1grq
SHA256 b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3d
MD5 76d7e0e4c1adf9a65b43c756597d7750
SHA1 21ae822a6a61450fc7f8c8f02f767f270b96927c
SHA512 884f80acf35191d83a7398287ccf8691fc77d52a65e8f5668c3d83becdd2bf7845a0937337d6fe586231bda7d5b5f5e7d186798aa0d0be5dc68ca2cb6441e17c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYy:vHW138/iXWlK885rKlGSekcj66ci3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	koidw.exe

Executes dropped EXE 2 IoCs

pid	Process
1896	koidw.exe
2844	biurr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biurr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	koidw.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe
2844	biurr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1896	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	82
PID 3668 wrote to memory of 1896	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	82
PID 3668 wrote to memory of 1896	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	82
PID 3668 wrote to memory of 1260	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	83
PID 3668 wrote to memory of 1260	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	83
PID 3668 wrote to memory of 1260	3668	b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe	83
PID 1896 wrote to memory of 2844	1896	koidw.exe	94
PID 1896 wrote to memory of 2844	1896	koidw.exe	94
PID 1896 wrote to memory of 2844	1896	koidw.exe	94

C:\Users\Admin\AppData\Local\Temp\b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe
"C:\Users\Admin\AppData\Local\Temp\b9739381d3220f2c8a019d553aa664fac22e18a95bdcff7ed473a54b9834de3dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\koidw.exe
  "C:\Users\Admin\AppData\Local\Temp\koidw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\biurr.exe
    "C:\Users\Admin\AppData\Local\Temp\biurr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 485820e3ac3939b8dbabd20dc282d7c39fc991b50f80898d1047340004e007f0
MD5 1dd5be40b171eefcec7649c82410f61c
SHA1 535fa73a93ee53218a704e9b1e5558beb81e1ec9
SHA512 70d7fe7554cc40866a9e53444603f0ed52ec9db738d010ed03abaecd1ceaca4e5d1f1bdd7757ba0b3351c52defa22b2e4d827b2092010286d3fd9286503ac150
MD5 SHA1 SHA512

Submit Download

biurr.exe

Path C:\Users\Admin\AppData\Local\Temp\biurr.exe
Size 172KB
SHA256 322b0168d450288c76a749d0e7a8c6caa8a9a83d8f3ba7c7400382f5fde58d7c
MD5 91dcdb17483cb97a733cad457a0a7dd9
SHA1 13631c463636039fce7de2c5e536fabc72caa704
SHA512 9008d08a6750da915c7787bdaf2c0467e2648883c2c2aaabd574f8f963879cb038080ad749cc65acb50c2c6af56da4d4853eb4176cab8eae5c7ae7b96e05ffbd
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGiff:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXN
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3bdd3f8a100e4d4ca353ca67b2a188246f19f5c381797478c3793acf21e0f5bc
MD5 f07baf4a3752405f8d7ddae62aec0c94
SHA1 8da4df9831888431cb5bca8d23d033a15d7b914b
SHA512 c81d071dcd71bced8c5580cc5de9e858150878ace2f0ae6987fc883bec7aadc2f2716982bb8ec18d4151cf30d50fdee6f3650427341d7144f7920cc707e08674
MD5 SHA1 SHA512

Submit Download

koidw.exe

Path C:\Users\Admin\AppData\Local\Temp\koidw.exe
Size 331KB
SHA256 725b3765ada7de6826571b1c501eee0009bbcf5f2d93a887596c8621ae9df8ea
MD5 4cabe0584a6a8e5b213e13409e0d4f73
SHA1 526684b9aa1104bf44ca67a2b07c0ca06629767f
SHA512 e45cc50c6fd9ba1bbe085d74c3933dc1a8c50681c315c21a1bbc54408e099f3ee5689d292fa2cd10f2a194962da7cb419cf0625b8dc7ad973b0edb809391fc35
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYD:vHW138/iXWlK885rKlGSekcj66ciW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-20-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/1896-14-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/1896-11-0x00000000006E0000-0x0000000000761000-memory.dmp

Download

memory/1896-19-0x00000000006E0000-0x0000000000761000-memory.dmp

Download

memory/1896-42-0x00000000006E0000-0x0000000000761000-memory.dmp

Download

memory/2844-36-0x00000000008B0000-0x0000000000949000-memory.dmp

Download

memory/2844-43-0x0000000000BC0000-0x0000000000BC2000-memory.dmp

Download

memory/2844-38-0x00000000008B0000-0x0000000000949000-memory.dmp

Download

memory/2844-45-0x00000000008B0000-0x0000000000949000-memory.dmp

Download

memory/2844-46-0x00000000008B0000-0x0000000000949000-memory.dmp

Download

memory/3668-16-0x0000000000070000-0x00000000000F1000-memory.dmp

Download

memory/3668-0-0x0000000000070000-0x00000000000F1000-memory.dmp

Download

memory/3668-1-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download