urelas | d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe
Size 330KB
Sample241004-b2dx8a1ena
SHA256 d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60
MD5 aea1974bd27fb7448157423ce3af86f0
SHA1 d12800176d6d63b4d8d53c1d0e757b72b872a596
SHA512 39574c5c4882c42aff8c94c3692a109362cf6a98b39710782e3e41ef947c05880ff070da28ab076bdf7a9e4b924cf547579ac0c7a55b250d5d56fa4abf419f50
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYV8:vHW138/iXWlK885rKlGSekcj66ciE8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	axdyv.exe

Executes dropped EXE 2 IoCs

pid	Process
4992	axdyv.exe
1964	juepn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	juepn.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe
1964	juepn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4992	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	82
PID 2128 wrote to memory of 4992	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	82
PID 2128 wrote to memory of 4992	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	82
PID 2128 wrote to memory of 3208	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	83
PID 2128 wrote to memory of 3208	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	83
PID 2128 wrote to memory of 3208	2128	d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe	83
PID 4992 wrote to memory of 1964	4992	axdyv.exe	94
PID 4992 wrote to memory of 1964	4992	axdyv.exe	94
PID 4992 wrote to memory of 1964	4992	axdyv.exe	94

C:\Users\Admin\AppData\Local\Temp\d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe
"C:\Users\Admin\AppData\Local\Temp\d2e0c5ff2620e132517b40adf160ed0622f4375b17b07983668ab34f3dffba60N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\axdyv.exe
  "C:\Users\Admin\AppData\Local\Temp\axdyv.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\juepn.exe
    "C:\Users\Admin\AppData\Local\Temp\juepn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 cc6a091f62ca5694ce2c33c332e5e01aca2a10fef02fadab1bce0f5b7b335e60
MD5 86431f097615104146ca5809e5e715f0
SHA1 d20e7f1398fc888f56a6d9b5b3dfae49ba86623e
SHA512 6d184c91db655ac66ceb7c9d04d9373189b7bd523d6efbebf18b6db26718939e3d5a43f4a17a171c98798e1250ceacfa39cc94ccb4b8707c684a239e061e962d
MD5 SHA1 SHA512

Submit Download

axdyv.exe

Path C:\Users\Admin\AppData\Local\Temp\axdyv.exe
Size 330KB
SHA256 4f33b10011b26d485022d7cd7746d94b8afef0f25ea5dd8ffc80b6878f778562
MD5 38c555bf87a53c944fe66dab14bc9648
SHA1 dc4c6739a4fa19e795355eb524bf54ab7aff0d5c
SHA512 56b3b8f728517ed6c245db6fc2bb94425901aad6cc889144d8c5c4967d11eac12e7106572f4e43ab33ac3dcf4e95eb0ab6e4ba9c1f9b645565edfe24b863cc9d
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVa:vHW138/iXWlK885rKlGSekcj66ciEa
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c3e722fadcba5d69b811e4ca11ce34b6c9b4734c9693720974190646284bd921
MD5 2da88323b2fc986e16b6030a89a87917
SHA1 3eaf3fe18d04feca045bec4fca28d1b6304fe169
SHA512 53b01c61d5c06180a254d51cf870b390f25ea050e8730c817eec1ab132a4f46f4ace1226ef1a49c94e047f6f60a15d60476fbaa3b9040d6598331b0fd9d79472
MD5 SHA1 SHA512

Submit Download

juepn.exe

Path C:\Users\Admin\AppData\Local\Temp\juepn.exe
Size 172KB
SHA256 3a7eb4bb07c6419e2f550a6d39453940e43c3c4c2411facbd0c91518ad279e2f
MD5 406cb3cf7cac2f7f72e98d8df51d8e2a
SHA1 79939d179cd86bc2900ea8dfbdd5fe7e2d362b1d
SHA512 175fa729a079a00f3b9e92f15b26fdf8b5ea74d0939151bfccc573030202c5d44180b24548a76e7153a5bf6aa8f31f10d6345139c6df057c1f0844a7e0b00f95
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifN:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-48-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1964-40-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1964-46-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1964-47-0x0000000000D00000-0x0000000000D02000-memory.dmp

Download

memory/1964-38-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1964-39-0x0000000000D00000-0x0000000000D02000-memory.dmp

Download

memory/2128-17-0x0000000000DC0000-0x0000000000E41000-memory.dmp

Download

memory/2128-0-0x0000000000DC0000-0x0000000000E41000-memory.dmp

Download

memory/2128-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/4992-14-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/4992-44-0x0000000000620000-0x00000000006A1000-memory.dmp

Download

memory/4992-20-0x0000000000620000-0x00000000006A1000-memory.dmp

Download

memory/4992-21-0x0000000000600000-0x0000000000601000-memory.dmp

Download

memory/4992-11-0x0000000000620000-0x00000000006A1000-memory.dmp

Download