urelas | b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe
Size 332KB
Sample241004-haf2tstbpb
SHA256 b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483
MD5 b6c4885120baa431d746e578a5e79810
SHA1 f0e12a3120741a8ec69d2ba6754cb981b6dbfc66
SHA512 9f11e4668366adcb89b598766a3c37eba93b14d0e5b93b84b47c0ac333e42ce4260cf80b7ba06d2ea1060a746a684bf2b1f0cab2e3c043d4e72c51ec139adb4a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY3:vHW138/iXWlK885rKlGSekcj66ciK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	puacp.exe

Executes dropped EXE 2 IoCs

pid	Process
4868	puacp.exe
4852	lyvoo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	puacp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lyvoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe
4852	lyvoo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4868	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	82
PID 3232 wrote to memory of 4868	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	82
PID 3232 wrote to memory of 4868	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	82
PID 3232 wrote to memory of 4668	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	83
PID 3232 wrote to memory of 4668	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	83
PID 3232 wrote to memory of 4668	3232	b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe	83
PID 4868 wrote to memory of 4852	4868	puacp.exe	94
PID 4868 wrote to memory of 4852	4868	puacp.exe	94
PID 4868 wrote to memory of 4852	4868	puacp.exe	94

C:\Users\Admin\AppData\Local\Temp\b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe
"C:\Users\Admin\AppData\Local\Temp\b44cb43f62d4159e819b0a79f1f567721396ea6e70285ce91b7b58e06e205483N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\puacp.exe
  "C:\Users\Admin\AppData\Local\Temp\puacp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\lyvoo.exe
    "C:\Users\Admin\AppData\Local\Temp\lyvoo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 8839ded36fe7225d594910d301e08c1bc822b57b1e26ff9b8bce152a89e4d722
MD5 0bb8060a906d960f3873f56158235812
SHA1 ee85c13566460ec5051280f0f7e8e6835d87dc84
SHA512 34b7d491eb04b521c81e3af93d41c13cc21a7937547f516963671b74b114edb27d22efce7b99db738a7bd7e46fd94dbb67189fb142b0b66bcd0a97f7b7e60efc
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1059a49bde94a39d4442486b817c1e19593f903108c5c7732e58d90416e1d06f
MD5 713ad5858af7c6fcae84234a3158efda
SHA1 ff7ebe81f3d4abd18d49050a17f8c59e6f291521
SHA512 e08b215041e29e00098a22ea576eb5f2f5ca0e2083dca20edfba04ec4944b046e4dbaa88e16d29ed73958e23d4853f2837f2bc71e01e5622681bc58551107d9e
MD5 SHA1 SHA512

Submit Download

lyvoo.exe

Path C:\Users\Admin\AppData\Local\Temp\lyvoo.exe
Size 172KB
SHA256 151918e3ab6b16c30d25225755807bad0d01b14ba23e103fa819b3cfa4c67e88
MD5 d5d24c9a155b63401f9d08654a33bea1
SHA1 c7602c00ddbeac55525d578328e0359126be827b
SHA512 f5b808b12007f127993648371ff4ce6ee0c5d03292dac4b3544f04e191b72372e98631a72c2411c2cef3c1f3ebb11b2733fa8eb13384c830e64589460465ad64
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifd:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

puacp.exe

Path C:\Users\Admin\AppData\Local\Temp\puacp.exe
Size 332KB
SHA256 280883c3d6d4effd9f2c69516f0225e805819a6441289efb63492e90cf5f20d3
MD5 bf01616a0618b82d5b4e7aa7c5658546
SHA1 589d4fde13aa07c0188db0af5884ccee7099950e
SHA512 24a5a38fb4467209f8e140c14b6477543b142c70bedff7877b932c3e409bd27396a4647c9374c9f6d211a003a7992c6735b109202366bff44e8ecf1a58a42c87
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYz:vHW138/iXWlK885rKlGSekcj66ci6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3232-1-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/3232-0-0x0000000000D00000-0x0000000000D81000-memory.dmp

Download

memory/3232-17-0x0000000000D00000-0x0000000000D81000-memory.dmp

Download

memory/4852-48-0x0000000000450000-0x00000000004E9000-memory.dmp

Download

memory/4852-46-0x0000000000450000-0x00000000004E9000-memory.dmp

Download

memory/4852-47-0x0000000001030000-0x0000000001032000-memory.dmp

Download

memory/4852-42-0x0000000000450000-0x00000000004E9000-memory.dmp

Download

memory/4852-39-0x0000000001030000-0x0000000001032000-memory.dmp

Download

memory/4852-38-0x0000000000450000-0x00000000004E9000-memory.dmp

Download

memory/4868-13-0x0000000000290000-0x0000000000311000-memory.dmp

Download

memory/4868-41-0x0000000000290000-0x0000000000311000-memory.dmp

Download

memory/4868-21-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/4868-20-0x0000000000290000-0x0000000000311000-memory.dmp

Download

memory/4868-14-0x0000000000710000-0x0000000000711000-memory.dmp

Download