urelas | 7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe
Size 331KB
Sample241004-24va4a1fpp
SHA256 7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43
MD5 e41bbb74d03ec7a124544ce050cdb7e0
SHA1 be36c29e325bff8538d2e2d16306da16315533f1
SHA512 836794427b93a9e973a3383693cb7d69c64b9aef86b572b46ba77b2e381727077329ba7bad6fa11b4a820e585f17ce95b352db97896f809ef40b3d92f43ea334
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYr:vHW138/iXWlK885rKlGSekcj66cia
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	wiavg.exe

Executes dropped EXE 2 IoCs

pid	Process
432	wiavg.exe
4568	goybo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiavg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	goybo.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe
4568	goybo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 432	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	82
PID 3724 wrote to memory of 432	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	82
PID 3724 wrote to memory of 432	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	82
PID 3724 wrote to memory of 2948	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	83
PID 3724 wrote to memory of 2948	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	83
PID 3724 wrote to memory of 2948	3724	7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe	83
PID 432 wrote to memory of 4568	432	wiavg.exe	94
PID 432 wrote to memory of 4568	432	wiavg.exe	94
PID 432 wrote to memory of 4568	432	wiavg.exe	94

C:\Users\Admin\AppData\Local\Temp\7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe
"C:\Users\Admin\AppData\Local\Temp\7aaaa27d54fc20494e36e4e1a0ec38f8a7856ad0033d212da864287fd233da43N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\wiavg.exe
  "C:\Users\Admin\AppData\Local\Temp\wiavg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Users\Admin\AppData\Local\Temp\goybo.exe
    "C:\Users\Admin\AppData\Local\Temp\goybo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 829e313b85930745239b2cda9edea3323e8515ab342fe5dd5b3b7bc4f84e787c
MD5 48b73b0a6eddce03703d59cd542dfcbd
SHA1 95633f7f245df2671176c928cbfee7e3a3722b19
SHA512 49c1a38843a180b3cf0598aadff6c59c758ab2b1b8aa4bd8163c6cd9c4b46ed8181d7d42cb19f68ec72eb7ad9a3d3283a51f177b903eacb45b530dffdad1d746
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b1d43d2b1fa564f1fbedadbaf30549bd027030f6dd5a321b6fca7f3ce11725ee
MD5 cb06d69ec53fefc17d0aa8f98145878f
SHA1 37e6f92fd89024f87615e254420e8f839eb9bbaa
SHA512 a995ae1daacae02b4f2c82005d505114ed5dd558e6049e61ad8117998cc7ec22e38a38a7e6ac25cf600244f2815dd5c9e1a617366d957fe1889bf9685419c765
MD5 SHA1 SHA512

Submit Download

goybo.exe

Path C:\Users\Admin\AppData\Local\Temp\goybo.exe
Size 172KB
SHA256 2ff645bd139178e3cd5eb32a70ef05664789ba301c1f87a54f1211526c6a8746
MD5 df862e805da8b1a2a205b5342b9637b0
SHA1 1aa7b9e05c6af8f770ecf59301538ca856658ef4
SHA512 7aa19aa84a53f432457fca978a01074dd6365787b16cc5fcc5a342ce1cb32406b567475bea5a8d39e4a004a92ef0f8fa2e5ec3f03ec3e4d03d83913a15da5a5b
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifb:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiavg.exe

Path C:\Users\Admin\AppData\Local\Temp\wiavg.exe
Size 331KB
SHA256 4f0f54ecc7075d821d3063b43a8ee7016b837c1afd88b6342dbfb4908dd24f8d
MD5 05cb4f287bcff8ba1052eb76ec51f42d
SHA1 26a14d215b254fe09893d29300f230fead9f1395
SHA512 3347be55887b5df0880d8f984bb1188bf6be44a0ea898f723b2ef84f5c96644d3d165aafb0755f2a56adc0c66b6617d7dc415adbf11d6d919db9947eddc96a28
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY0:vHW138/iXWlK885rKlGSekcj66ci1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-20-0x0000000000DF0000-0x0000000000E71000-memory.dmp

Download

memory/432-41-0x0000000000DF0000-0x0000000000E71000-memory.dmp

Download

memory/432-11-0x0000000000DF0000-0x0000000000E71000-memory.dmp

Download

memory/432-14-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/432-21-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/3724-0-0x00000000006A0000-0x0000000000721000-memory.dmp

Download

memory/3724-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/3724-17-0x00000000006A0000-0x0000000000721000-memory.dmp

Download

memory/4568-42-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4568-39-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4568-38-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4568-46-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4568-47-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download

memory/4568-48-0x0000000000D40000-0x0000000000DD9000-memory.dmp

Download