urelas | 9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4b

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe
Size 329KB
Sample241003-11krtaygrk
SHA256 9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4b
MD5 e4218115839dc46f739f38e94472d450
SHA1 5740984664f932d08b706cf66feb4cf7cff4b145
SHA512 df196d07df88d81c06783fabf3c0517ab4965e5d0dc230fafe073f839174a6cfe4422d8b3f37f656f1c967706d89b491adbd87d85f9aef4151b1613c8a6ada11
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVg:vHW138/iXWlK885rKlGSekcj66ciEg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	jeefx.exe

Executes dropped EXE 2 IoCs

pid	Process
1376	jeefx.exe
2784	uxivd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeefx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uxivd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe
2784	uxivd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1376	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	82
PID 1644 wrote to memory of 1376	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	82
PID 1644 wrote to memory of 1376	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	82
PID 1644 wrote to memory of 4312	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	83
PID 1644 wrote to memory of 4312	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	83
PID 1644 wrote to memory of 4312	1644	9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe	83
PID 1376 wrote to memory of 2784	1376	jeefx.exe	94
PID 1376 wrote to memory of 2784	1376	jeefx.exe	94
PID 1376 wrote to memory of 2784	1376	jeefx.exe	94

C:\Users\Admin\AppData\Local\Temp\9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe
"C:\Users\Admin\AppData\Local\Temp\9d7ec4d58d6ffedc335fe7a03add9a1722a1dbb020157b57961d7c36647adc4bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\jeefx.exe
  "C:\Users\Admin\AppData\Local\Temp\jeefx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\uxivd.exe
    "C:\Users\Admin\AppData\Local\Temp\uxivd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 b53e1fbcfc8b0a30b9b2d77ed4e054832f4316266c791f95dc2098375696db2e
MD5 9a6027364128b257bf9a6998762a3cb0
SHA1 d8d8f5794f52774e9bbeda47f2a8ba73e86d0e51
SHA512 9925b98d41bbc8ef60574a8fa31a57d282a7d155c8dafe4a50d6beeac2938ae4078c05fbc873669991d7db09559a08597d3106169be82e6aca6b20ca387f5e25
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 59aab9981c8d84b76c1be404ecfc2fbabe3da1cadec51493bc96adf9a6fe374d
MD5 4d20ebe9e8b2f9f12de1aa5cedda91ea
SHA1 1421e5f94aa9d166b503bc6e8d053fce2ed9bf20
SHA512 b3db84eaf559d423769592aecb060b6b8c300a1226370635723a8bbe5ab47b69d6b3834d9d1dd5795f897b723f8192a8c2f57e1302dc19351ab05a00ebe6d323
MD5 SHA1 SHA512

Submit Download

jeefx.exe

Path C:\Users\Admin\AppData\Local\Temp\jeefx.exe
Size 329KB
SHA256 fe63d5041333563e785f3254c4fca6f8f447fdd31eadf52e8825e588dc6d0662
MD5 b786e8f13e5f44ef4d5d35f7e1f117a8
SHA1 835999e95faec2f5c5e7f2bf81f5f597baea224d
SHA512 e1e64f4c0949849f37fbced46e4185ab3bd98cde3002ef454bd39c6620f7f0d24f4d8f299cb7195d7e2c786711d83d03b5fd490125864356ed4837595997d6f1
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVU:vHW138/iXWlK885rKlGSekcj66ciEU
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxivd.exe

Path C:\Users\Admin\AppData\Local\Temp\uxivd.exe
Size 172KB
SHA256 6e26d4ec0f3045b9422eb75256aa2fca8e67f00f3328a592601e563c2b85ca77
MD5 5a992262660ba745b0e9b9a7aa4b868c
SHA1 e2a7f0c2f73ac728da3ee995c66b735786b3dc79
SHA512 e38f0fab4015b548ca5bba59c3537a15cc8b170e30e417123d5a4575f9a5884ebdd600f6db9607d5ff8b2bfd31f46bce5f211f064b511dc8005923a0d76869fd
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifw:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-20-0x00000000006A0000-0x0000000000721000-memory.dmp

Download

memory/1376-11-0x00000000006A0000-0x0000000000721000-memory.dmp

Download

memory/1376-14-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/1376-43-0x00000000006A0000-0x0000000000721000-memory.dmp

Download

memory/1644-17-0x0000000000F10000-0x0000000000F91000-memory.dmp

Download

memory/1644-0-0x0000000000F10000-0x0000000000F91000-memory.dmp

Download

memory/1644-1-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2784-38-0x00000000005D0000-0x00000000005D2000-memory.dmp

Download

memory/2784-37-0x0000000000D50000-0x0000000000DE9000-memory.dmp

Download

memory/2784-39-0x0000000000D50000-0x0000000000DE9000-memory.dmp

Download

memory/2784-46-0x00000000005D0000-0x00000000005D2000-memory.dmp

Download

memory/2784-45-0x0000000000D50000-0x0000000000DE9000-memory.dmp

Download

memory/2784-47-0x0000000000D50000-0x0000000000DE9000-memory.dmp

Download