urelas | 2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47b

Analysis

max time kernel
119s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe
Size 330KB
Sample241001-1mq2nssapp
SHA256 2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47b
MD5 6ce0f92bd7abbc332da8f4ef6cc433a0
SHA1 06c1b85bcbd0f8fba406ab9c979a798738db3747
SHA512 675b33e2b95f5f57594a2be841a12e3e19ac7812aa7e199336a634e6d38314c918a82a78531f6d07ba908160f0e34d483ddd4d20569c42512037d1bbccecb91f
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYY:vHW138/iXWlK885rKlGSekcj66ci9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	kuxay.exe

Executes dropped EXE 2 IoCs

pid	Process
3092	kuxay.exe
4268	armyn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kuxay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe
4268	armyn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3092	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	82
PID 4100 wrote to memory of 3092	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	82
PID 4100 wrote to memory of 3092	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	82
PID 4100 wrote to memory of 3964	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	83
PID 4100 wrote to memory of 3964	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	83
PID 4100 wrote to memory of 3964	4100	2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe	83
PID 3092 wrote to memory of 4268	3092	kuxay.exe	94
PID 3092 wrote to memory of 4268	3092	kuxay.exe	94
PID 3092 wrote to memory of 4268	3092	kuxay.exe	94

C:\Users\Admin\AppData\Local\Temp\2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe
"C:\Users\Admin\AppData\Local\Temp\2a096e6e0405c8b6a63f10bd7ee05511a13a05ab033cb2ea164db1ec5272a47bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\kuxay.exe
  "C:\Users\Admin\AppData\Local\Temp\kuxay.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\armyn.exe
    "C:\Users\Admin\AppData\Local\Temp\armyn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 983a3bb98d44c59326e546bd5af9b48ef854c49d67160624a93ba1279b1b3d4a
MD5 49959b3a428ad505e68487df418207cd
SHA1 680f9ced11c0fae4868b2c76bba7833dc76475ff
SHA512 611c89147c783ffeac208d6fc518ddcffc2abf50ef0255df80199b69c16618b1f6fc20cd786aee869b82d0188ef6404f34ed8634402be3c30912c3fbad6c9fd8
MD5 SHA1 SHA512

Submit Download

armyn.exe

Path C:\Users\Admin\AppData\Local\Temp\armyn.exe
Size 172KB
SHA256 f22dd1942b074ebaf39bbf4aa477bcd38b51ff20d9f043861c960bb33b5bceb0
MD5 c2515640ac3a17e1b87cd195dccc9682
SHA1 9b39cb0af134cbe1577c77cc5aae0f5a9de6227b
SHA512 250186c0e16be4b9eaec4cbe2c97efd835fe4451262072a475b75d605b2112ae53356246864798b38021f52565da5cb92ed034c0d2ed9d00e8a51dbc15654049
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifY:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 aeaf97fbc3c7ad7f6831fd47dbdc2a01e1074da7a6db84ea651f6cfb8b1e2b47
MD5 5b0a3d153a422a1254222863c5fbc442
SHA1 3bf794e80d7546a2f8fea380ba133c111039e56c
SHA512 79b4e2deb191238e5c21a2b87694f3980535e7ba9e826a4b898b81256517d2c0127fd3a40b9bb8d78f9acd8d2b4f80d8d077260d5d6fd53f869bd6d012249f97
MD5 SHA1 SHA512

Submit Download

kuxay.exe

Path C:\Users\Admin\AppData\Local\Temp\kuxay.exe
Size 330KB
SHA256 5b0f971edf9baa0686fe17f87b8e58c32dd32d08f9ce8426638fea1f6e3b066e
MD5 f765ecab2721c24f4486cab4b6f3d9ce
SHA1 e9f1a309350e423eccfdaadd85be0ee08e1c16cc
SHA512 66ede10e880180852f86c9023c042f6d13e2add5f98db55cd83f0040c07accc1cda921158cb4c2feb70d439b513642cf34d12aa4cf26ec4e884322ce01894145
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYV:vHW138/iXWlK885rKlGSekcj66ciQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3092-39-0x0000000000090000-0x0000000000111000-memory.dmp

Download

memory/3092-11-0x0000000000090000-0x0000000000111000-memory.dmp

Download

memory/3092-14-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

memory/3092-20-0x0000000000090000-0x0000000000111000-memory.dmp

Download

memory/3092-21-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

memory/4100-17-0x0000000000700000-0x0000000000781000-memory.dmp

Download

memory/4100-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/4100-0-0x0000000000700000-0x0000000000781000-memory.dmp

Download

memory/4268-37-0x00000000009C0000-0x0000000000A59000-memory.dmp

Download

memory/4268-41-0x00000000009C0000-0x0000000000A59000-memory.dmp

Download

memory/4268-44-0x0000000000BB0000-0x0000000000BB2000-memory.dmp

Download

memory/4268-46-0x00000000009C0000-0x0000000000A59000-memory.dmp

Download

memory/4268-47-0x00000000009C0000-0x0000000000A59000-memory.dmp

Download