urelas | 1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe
Size 331KB
Sample241004-hfyttstdre
SHA256 1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754
MD5 cf5c08b25c21683a077d908a07246850
SHA1 1c6120dd70615b1d09a7711e4c825f4a62cf37e8
SHA512 39302ceef2b6904e5abd456722658ad6844de5f6e799d1e0936ceb9252878a3ac22ad3b77d1c2ce4ab572c2d3bc64c27af7cf08356aececded13956a6c33c7e3
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYx:vHW138/iXWlK885rKlGSekcj66ciU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	ejxuu.exe

Executes dropped EXE 2 IoCs

pid	Process
3260	ejxuu.exe
2856	gizuh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejxuu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gizuh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe
2856	gizuh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3260	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	82
PID 2972 wrote to memory of 3260	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	82
PID 2972 wrote to memory of 3260	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	82
PID 2972 wrote to memory of 3148	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	83
PID 2972 wrote to memory of 3148	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	83
PID 2972 wrote to memory of 3148	2972	1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe	83
PID 3260 wrote to memory of 2856	3260	ejxuu.exe	94
PID 3260 wrote to memory of 2856	3260	ejxuu.exe	94
PID 3260 wrote to memory of 2856	3260	ejxuu.exe	94

C:\Users\Admin\AppData\Local\Temp\1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe
"C:\Users\Admin\AppData\Local\Temp\1e0254ad94a994d0f23bbd58b177f38538fc133ac7b006c3100aa78d19652754N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\ejxuu.exe
  "C:\Users\Admin\AppData\Local\Temp\ejxuu.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\gizuh.exe
    "C:\Users\Admin\AppData\Local\Temp\gizuh.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 08958cc88cc58b42d9fb0e8b477b1c781b0e656da45ba973ee2547ec79a776e5
MD5 e118461ab2ea0954890f9b1c12e2699a
SHA1 cc9a9d8f8e4484e2d7e3ee2b9cb6ca5960e38ca6
SHA512 f71fff2915bcedeaf5afa05eb8204e1386280e1b082a5016c947a91bda0d92bac56d4f312b383644c99722b7f2b2f07447bd04d9b0670591ef3608103e6955a9
MD5 SHA1 SHA512

Submit Download

ejxuu.exe

Path C:\Users\Admin\AppData\Local\Temp\ejxuu.exe
Size 331KB
SHA256 1e563a796dc5f15e53c791c6c847a33baa48503273f2ec4f228f9fb830113ea1
MD5 f57f42df75a7401c7611ac7927204ae4
SHA1 81d64a5e03078ed3c28900ef9ad8c9deea874db8
SHA512 32c97fe0e5d90163d6eec80c9dd92229c50e3687f27dd4005238ccc5b6433b0ebf735ec8fd19c7aa6e49255e97e785c5946be23ebafe11a14f7d5a9075f79f56
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY+:vHW138/iXWlK885rKlGSekcj66cin
MD5 SHA1 SHA512 SSDEEP

Submit Download

gizuh.exe

Path C:\Users\Admin\AppData\Local\Temp\gizuh.exe
Size 172KB
SHA256 93b1087e33d8013481ad6557962f0df2395d1c03b2d6784ca6c20a51abb55d11
MD5 9375578ee2305f14e6209a6abcdf694b
SHA1 ff7e88f9a6a815065b5eb8bc7bf9d5d304ca50c7
SHA512 868273d5173afacaead188cc1d60db443a99475fe7fe16bcd8f1820ced63dcf408a31bd960e03d1cc91d039a2f2a90e9f5e690b72afbb0c061070689e84510b1
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifp:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ecd112a9256977ab2e848253a4a18b2f3827cda66de566c06004ad5d99148c43
MD5 75200dfb447d3f95ae44a8b1e08f65aa
SHA1 90fb6558b3d7963c7bcd34fc76411fb884f2973e
SHA512 d507a623fabfa9a630073d2cd2ad33598c3d519cd0acb28bdb89c7d39d33f639344325b5066662894b05fbcab60f30110f4939dbb68e9c104ad59ca848ded828
MD5 SHA1 SHA512

Submit Download

memory/2856-45-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-47-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-50-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-49-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-37-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-48-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-40-0x0000000000770000-0x0000000000772000-memory.dmp

Download

memory/2856-41-0x0000000000A00000-0x0000000000A99000-memory.dmp

Download

memory/2856-46-0x0000000000770000-0x0000000000772000-memory.dmp

Download

memory/2972-17-0x00000000007A0000-0x0000000000821000-memory.dmp

Download

memory/2972-1-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/2972-0-0x00000000007A0000-0x0000000000821000-memory.dmp

Download

memory/3260-20-0x0000000000B70000-0x0000000000BF1000-memory.dmp

Download

memory/3260-39-0x0000000000B70000-0x0000000000BF1000-memory.dmp

Download

memory/3260-11-0x0000000000B70000-0x0000000000BF1000-memory.dmp

Download

memory/3260-14-0x00000000011C0000-0x00000000011C1000-memory.dmp

Download