urelas | 50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe
Size 505KB
Sample241001-gnkfqstfkr
SHA256 50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821
MD5 ffd51bbb503dc754a220138cd34d4990
SHA1 ffc849d79f5b06aca4783607ffeb2b8c65c78173
SHA512 bb9d71648a4117e1ff815d4049cee61d69ef030e1fcc8761d6b71068d8c6be8d7b16f948e6fa10b3c1557556197397e966c19ee3d8251c1fdd9727f3beaa911d
SSDEEP 12288:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKod:3MUv2LAv9AQ1p4dKg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	byuvw.exe

Executes dropped EXE 2 IoCs

pid	Process
5072	byuvw.exe
1192	zubie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zubie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byuvw.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe
1192	zubie.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 5072	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	82
PID 1360 wrote to memory of 5072	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	82
PID 1360 wrote to memory of 5072	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	82
PID 1360 wrote to memory of 3016	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	83
PID 1360 wrote to memory of 3016	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	83
PID 1360 wrote to memory of 3016	1360	50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe	83
PID 5072 wrote to memory of 1192	5072	byuvw.exe	94
PID 5072 wrote to memory of 1192	5072	byuvw.exe	94
PID 5072 wrote to memory of 1192	5072	byuvw.exe	94

C:\Users\Admin\AppData\Local\Temp\50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe
"C:\Users\Admin\AppData\Local\Temp\50f73d2e10f7398e4466d9c06ac1e91bd9cbed160d16a84c9813702974210821N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\byuvw.exe
  "C:\Users\Admin\AppData\Local\Temp\byuvw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\zubie.exe
    "C:\Users\Admin\AppData\Local\Temp\zubie.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 73f72ebde8a231d284ca79abc577e78663b4c8c4501105aa3f1250240261621a
MD5 62d8d6e52e26d0b3a759fd592610e9b2
SHA1 ee8165f52415c1f39451d8908d75e53f1be5dad7
SHA512 002cc0c3db3ad0c710cc19f3f9a89f34dc4b05450ec8f2784ebed48f2d0fccde2e6cf9bb353feda8eda0fe172e94d472f862ba6e64e12dc4ee5da850e5838b89
MD5 SHA1 SHA512

Submit Download

byuvw.exe

Path C:\Users\Admin\AppData\Local\Temp\byuvw.exe
Size 505KB
SHA256 7a1fc9f998a79bfed3380416314d5347bec75cc03928fc97d03d4b06ba747d3b
MD5 46ceb28b9d1d303346da37261fdb3c40
SHA1 385db790a6e00c85fa84b563eb4465406a55b736
SHA512 aece293bae63602ea0d50dce053e298845dbdb43bf7ac1c1b9f1dab0ae68708cd7aff652ba3cb7bcfd7da7cc3176db807746f70c468df7a1e7a39ad6cd59598e
SSDEEP 12288:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKo1:3MUv2LAv9AQ1p4dKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1717e12bfb4b95caba8f81f39392b9cc87765e38dbe9848f15ed9bd6ae603991
MD5 c9af4cbd491246dd222d8b8865ac0ac7
SHA1 3b97f6a0bffa1daa3c65fb578e8516636ed23177
SHA512 e2ee1ecfb23219e2f68182d238ab7993871895030d9e737f8934f6e6fde59e4a76161a3e6f9240bd3738d70d8ad93b276c02c15ec94d25fcaa364640eae99750
MD5 SHA1 SHA512

Submit Download

zubie.exe

Path C:\Users\Admin\AppData\Local\Temp\zubie.exe
Size 172KB
SHA256 279b6f09eae4bd008372cbf9645591cfc226f2abfb2d7248829110720d4af9c8
MD5 53be9c0777ee46945dbc6d44a3570143
SHA1 24753fca5a3b9860e8dccde2ef7dca1bee4ebf97
SHA512 be4a3d6765ceee2110351e2d1ea0b743ffa88de4164eb7ce2971dc40a8da4b4921ed0a5c49073531d07b28de1e910def39e5c82da539106693227c765890bbdd
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifDn:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-29-0x0000000000FA0000-0x0000000001039000-memory.dmp

Download

memory/1192-35-0x0000000000FA0000-0x0000000001039000-memory.dmp

Download

memory/1192-33-0x0000000000FA0000-0x0000000001039000-memory.dmp

Download

memory/1192-34-0x0000000000360000-0x0000000000362000-memory.dmp

Download

memory/1192-25-0x0000000000FA0000-0x0000000001039000-memory.dmp

Download

memory/1192-28-0x0000000000360000-0x0000000000362000-memory.dmp

Download

memory/1360-14-0x0000000000A00000-0x0000000000A81000-memory.dmp

Download

memory/1360-0-0x0000000000A00000-0x0000000000A81000-memory.dmp

Download

memory/5072-27-0x0000000000D30000-0x0000000000DB1000-memory.dmp

Download

memory/5072-17-0x0000000000D30000-0x0000000000DB1000-memory.dmp

Download

memory/5072-12-0x0000000000D30000-0x0000000000DB1000-memory.dmp

Download