urelas | cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
Size 331KB
Sample241004-wtf3tsshkc
SHA256 cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657
MD5 9ac55f3c545adb91b9c8b5a283b72ef0
SHA1 52b8e6ff20caea12825b13a8c3d64c064928fb17
SHA512 6af99b248ce323119f580a525ffd0f5dc93c402a8b55bdcc19930c826d7063acd7292412736cbcf8fb96ddd8ad82a6b9a82d79d93acd1a91ef19b72a2aff5e1c
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYp:vHW138/iXWlK885rKlGSekcj66ciw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	efjaw.exe

Executes dropped EXE 2 IoCs

pid	Process
1808	efjaw.exe
1680	ubovc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ubovc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efjaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe
1680	ubovc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1808	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	82
PID 2480 wrote to memory of 1808	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	82
PID 2480 wrote to memory of 1808	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	82
PID 2480 wrote to memory of 3832	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 2480 wrote to memory of 3832	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 2480 wrote to memory of 3832	2480	cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe	83
PID 1808 wrote to memory of 1680	1808	efjaw.exe	94
PID 1808 wrote to memory of 1680	1808	efjaw.exe	94
PID 1808 wrote to memory of 1680	1808	efjaw.exe	94

C:\Users\Admin\AppData\Local\Temp\cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe
"C:\Users\Admin\AppData\Local\Temp\cf1b8a94876fa731ae3fb0e13e2747a1b486ea88f88c3c45e9bb51f7fdd36657N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\efjaw.exe
  "C:\Users\Admin\AppData\Local\Temp\efjaw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\ubovc.exe
    "C:\Users\Admin\AppData\Local\Temp\ubovc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 ee9295e7a7fab36a77fa920c44a4e96d96744376dd4117367b19989cf0a7d623
MD5 8702ea9bff4f59b69d1600dadcd2ca81
SHA1 81315e3b2ee37c3a452c1aed3f820601c20b85dc
SHA512 a02eb2a2d293dd99d8bdd064a098d8458f6705ed12b1e6bf645f4424ec6b20edc49571ee3ec7552ae5d83b4daf95b2db461940ff3b3d41c69b2047be88ecd714
MD5 SHA1 SHA512

Submit Download

efjaw.exe

Path C:\Users\Admin\AppData\Local\Temp\efjaw.exe
Size 331KB
SHA256 e2967cc02b52547f9ebf629775b6ea350486c78fa1e5a12ee339dd32540e08f5
MD5 4b4f39e47d4a8f0db287bed8457014d0
SHA1 50c5234103481d3f866a9e69f830226c649c8f5e
SHA512 e1c97879967be09512d57d8bc3f45772970e205b4ceaa9f9eec5ed870f2b46fe57455cebb51089f81f3343496dff9330bb8fcd5ee0e52a3acb658b4bf6838850
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY8:vHW138/iXWlK885rKlGSekcj66cip
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 19ec40f1aece1e451fa2ac4448566143e6c1fea13c012b8c51448a9eb583cc79
MD5 cf6aeb9deb9e06682a0f1e3592faaaca
SHA1 383c31fab3970498a48c9dc15839f477c0a9d280
SHA512 d9461d41601717ff53fbba760624ea53cb788a92e20e7883c37bc0b7eeabb5e9daf36a12bfc678bdc322030520763f5cba01003db656a44e3e2d57a91528825c
MD5 SHA1 SHA512

Submit Download

ubovc.exe

Path C:\Users\Admin\AppData\Local\Temp\ubovc.exe
Size 172KB
SHA256 55fc55858a4ebabecb158c7fb7d8986848351233863cdecfddcd07403185897e
MD5 39dedf76bbd6733ae0f8488c7d9602d0
SHA1 159e33bf26d613751746271a573e19cf7e20c7b6
SHA512 953ccc308e817df52ff00109aef03ff2eb6df35957411d54332de165f3cf5ba4fc6e2fc941b9b59a0cb4b4a3a0ce22eb42810bc07a564246e0cc778bac1aee60
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif2:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-46-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-38-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-50-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-49-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-48-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-47-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1680-42-0x0000000000EE0000-0x0000000000EE2000-memory.dmp

Download

memory/1680-41-0x00000000003D0000-0x0000000000469000-memory.dmp

Download

memory/1808-44-0x0000000000140000-0x00000000001C1000-memory.dmp

Download

memory/1808-13-0x0000000000140000-0x00000000001C1000-memory.dmp

Download

memory/1808-21-0x0000000000140000-0x00000000001C1000-memory.dmp

Download

memory/1808-20-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/1808-14-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/2480-1-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/2480-0-0x0000000000150000-0x00000000001D1000-memory.dmp

Download

memory/2480-17-0x0000000000150000-0x00000000001D1000-memory.dmp

Download