urelas | 0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acded

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe
Size 325KB
Sample240930-cbrbas1hpj
SHA256 0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acded
MD5 67983a38c0361caf3eb54e8b04e211e0
SHA1 b71d0d563782af33899acc02103de9e07bb481ac
SHA512 603e26cf37525e2a30a5aa0783cd18238d74511c05fd90f4399bd46ee8c695bbc4bce0436e354d55e3531c5c84678f47747735f147e5051221ef9963488bf918
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOL:vHW138/iXWlK885rKlGSekcj66ciE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	seruh.exe

Executes dropped EXE 2 IoCs

pid	Process
4556	seruh.exe
2648	yqavu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seruh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqavu.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe
2648	yqavu.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 4556	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	90
PID 2308 wrote to memory of 4556	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	90
PID 2308 wrote to memory of 4556	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	90
PID 2308 wrote to memory of 1112	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	91
PID 2308 wrote to memory of 1112	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	91
PID 2308 wrote to memory of 1112	2308	0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe	91
PID 4556 wrote to memory of 2648	4556	seruh.exe	104
PID 4556 wrote to memory of 2648	4556	seruh.exe	104
PID 4556 wrote to memory of 2648	4556	seruh.exe	104

C:\Users\Admin\AppData\Local\Temp\0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe
"C:\Users\Admin\AppData\Local\Temp\0dedd7d88c23b140c14eb4192f1aaaba24706675b59282da0ebc9dea120acdedN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\seruh.exe
  "C:\Users\Admin\AppData\Local\Temp\seruh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\yqavu.exe
    "C:\Users\Admin\AppData\Local\Temp\yqavu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 9a6ef324c76c4ce3872564d14b681006339aaceea378fd0e91a5c190c7f5e521
MD5 9053bfc4e1fcb81c256e5ade6a9bd381
SHA1 3f001bcc7d0e18f5b32a195020ef31e7632478ff
SHA512 64a7b3220d5ae0560c0e328b02b0bda5c5b6c7b4ad5e3e786a0e22568443afcae92c58f50740b9835562d79bc28e2d1ec325ef1212bf731aeb7641284d0f1c21
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3aa989c1d8b9b12aa61e0ef706d7c707eb844175f52caa6f35527221d0237757
MD5 30e944624ab2fd67fdae3fcbff3fc4a1
SHA1 1032a8004b7e7d36e9ca7b5e7e377d4bda864d0b
SHA512 0c58afc7fbcf41a0da7f79b84e89af17596c29db0fef744e09f45a4e29595a976a731fbaca6b71e04ff9ec5fb437fbcd7ba63694493a612f8c0d30794cd96f2d
MD5 SHA1 SHA512

Submit Download

seruh.exe

Path C:\Users\Admin\AppData\Local\Temp\seruh.exe
Size 325KB
SHA256 b0e8fbb711a10fdcc94b27dc19fe2f7e6f219debd7e3d2638271bdf0fb3518dd
MD5 20384515e2490c23fbdc4b3b39bc5705
SHA1 9f40d9a702973b02fcc3abbb4f6e79edae6eef96
SHA512 73fae94420604a61e7da885ea29e6d2439eb2f0141d76a322e00789d9db93def5af2c1db040178aeacde1f5cee1621fd6ff36dd864d7edf701b6ec2a0d7ad25f
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOy:vHW138/iXWlK885rKlGSekcj66cit
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqavu.exe

Path C:\Users\Admin\AppData\Local\Temp\yqavu.exe
Size 172KB
SHA256 5b482c4fe94c192409f07be3322b8e11f09008b500277ea0cb16ca6126cec22f
MD5 325e357d6f2f4f8c1c0d837b8d1e56fb
SHA1 7624ba0f010931caa51d2eb9ec46adc794479de4
SHA512 e134b50dc689940c76dcb4745e63d867646f4415e75738325ea3670b7638c9deaa2c74a3256b310511d14593f838b6b53ee9c22515c2e8667508163372a003bd
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif9:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2308-0-0x0000000000350000-0x00000000003D1000-memory.dmp

Download

memory/2308-16-0x0000000000350000-0x00000000003D1000-memory.dmp

Download

memory/2308-1-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/2648-46-0x00000000006F0000-0x0000000000789000-memory.dmp

Download

memory/2648-44-0x00000000006F0000-0x0000000000789000-memory.dmp

Download

memory/2648-40-0x00000000006F0000-0x0000000000789000-memory.dmp

Download

memory/2648-35-0x00000000006F0000-0x0000000000789000-memory.dmp

Download

memory/2648-45-0x0000000000B70000-0x0000000000B72000-memory.dmp

Download

memory/2648-39-0x0000000000B70000-0x0000000000B72000-memory.dmp

Download

memory/4556-13-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/4556-37-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/4556-19-0x0000000000550000-0x00000000005D1000-memory.dmp

Download

memory/4556-14-0x0000000001260000-0x0000000001261000-memory.dmp

Download