urelas | cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
Size 331KB
Sample241004-wqeqlaybmj
SHA256 cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657
MD5 9ac55f3c545adb91b9c8b5a283b72ef0
SHA1 52b8e6ff20caea12825b13a8c3d64c064928fb17
SHA512 6af99b248ce323119f580a525ffd0f5dc93c402a8b55bdcc19930c826d7063acd7292412736cbcf8fb96ddd8ad82a6b9a82d79d93acd1a91ef19b72a2aff5e1c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYp:vHW138/iXWlK885rKlGSekcj66ciw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	kabob.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe

Executes dropped EXE 2 IoCs

pid	Process
3732	kabob.exe
848	qikud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qikud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kabob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe
848	qikud.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3732	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 1144 wrote to memory of 3732	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 1144 wrote to memory of 3732	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 1144 wrote to memory of 844	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	84
PID 1144 wrote to memory of 844	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	84
PID 1144 wrote to memory of 844	1144	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	84
PID 3732 wrote to memory of 848	3732	kabob.exe	95
PID 3732 wrote to memory of 848	3732	kabob.exe	95
PID 3732 wrote to memory of 848	3732	kabob.exe	95

C:\Users\Admin\AppData\Local\Temp\cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
"C:\Users\Admin\AppData\Local\Temp\cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\kabob.exe
  "C:\Users\Admin\AppData\Local\Temp\kabob.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\qikud.exe
    "C:\Users\Admin\AppData\Local\Temp\qikud.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 ee9295e7a7fab36a77fa920c44a4e96d96744376dd4117367b19989cf0a7d623
MD5 8702ea9bff4f59b69d1600dadcd2ca81
SHA1 81315e3b2ee37c3a452c1aed3f820601c20b85dc
SHA512 a02eb2a2d293dd99d8bdd064a098d8458f6705ed12b1e6bf645f4424ec6b20edc49571ee3ec7552ae5d83b4daf95b2db461940ff3b3d41c69b2047be88ecd714
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 bc53351eb73d1ae77b2980df8fb6fc3a080d864e8cf849742f230434f3ce8ece
MD5 2c599448a739943e222fca2355257c14
SHA1 31f549508a6f7124fbccf080cd3c30363e964445
SHA512 edc6d77c8908fa26e37cc862cedb868996ab9406ca689181db4389303ce1304fae093281f958ddfb3d96bcdab8c8dbba7a487d007abac92af8d8edc20d133a86
MD5 SHA1 SHA512

Submit Download

kabob.exe

Path C:\Users\Admin\AppData\Local\Temp\kabob.exe
Size 331KB
SHA256 26df40bb21a566ddc2c21ea76462bacff3c3371e5f2f4024d1f08e05de70bb29
MD5 fd359e977b1c2369e8f111552dc82c5f
SHA1 9e51046da81f080bfe19a9fd82dff20acfa72049
SHA512 3da179741ef43cc1e4b1a9061dbed6bef1e5a915bc5e35f44d9f918719bdd35bc205abe644ed62905c4f436c3845b7957dd2d58d28fa96e7fb41ba6e65122da1
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY1:vHW138/iXWlK885rKlGSekcj66ci4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qikud.exe

Path C:\Users\Admin\AppData\Local\Temp\qikud.exe
Size 172KB
SHA256 8fd9fef02c70d5657ee9641dc2e51fec1a13c78c900908317927f3d6e35a5cc4
MD5 cc5af958b77015ba965eb773096c7c80
SHA1 55fb382ee2e48bc71d399b057cd3037c16f2437b
SHA512 b464e8aaa325d1bbc79fbfe9f37955372b2b6418d639bdcf161d6046882bd785d96456366037405ac2fea2a2ed6ae08a8c3d96b17b03797e88d854c95912d236
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifL:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/848-43-0x00000000009F0000-0x00000000009F2000-memory.dmp

Download

memory/848-46-0x00000000003A0000-0x0000000000439000-memory.dmp

Download

memory/848-45-0x00000000003A0000-0x0000000000439000-memory.dmp

Download

memory/848-37-0x00000000003A0000-0x0000000000439000-memory.dmp

Download

memory/848-41-0x00000000003A0000-0x0000000000439000-memory.dmp

Download

memory/1144-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/1144-17-0x00000000008B0000-0x0000000000931000-memory.dmp

Download

memory/1144-0-0x00000000008B0000-0x0000000000931000-memory.dmp

Download

memory/3732-20-0x00000000007A0000-0x0000000000821000-memory.dmp

Download

memory/3732-39-0x00000000007A0000-0x0000000000821000-memory.dmp

Download

memory/3732-14-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

memory/3732-11-0x00000000007A0000-0x0000000000821000-memory.dmp

Download