urelas | 564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe
Size 331KB
Sample241005-pa3ddsxdmd
SHA256 564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6
MD5 151eccb7dfb2892e6091594da8ea0b20
SHA1 9a9a6b3aea9e271477dfdb55b66467b4254d63af
SHA512 57e9efa766bf75981d873f05d88e9a67fc92572c798f9b79abf74a1b62bc56a5362dd29b0715d243698c1341e73c83aa77ffdc0beb4c85533f9fc9485186d75f
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYH6:vHW138/iXWlK885rKlGSekcj66ciL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	kyfuj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe

Executes dropped EXE 2 IoCs

pid	Process
5032	kyfuj.exe
3980	goduh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	goduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyfuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe
3980	goduh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5032	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	82
PID 4616 wrote to memory of 5032	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	82
PID 4616 wrote to memory of 5032	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	82
PID 4616 wrote to memory of 2404	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	83
PID 4616 wrote to memory of 2404	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	83
PID 4616 wrote to memory of 2404	4616	564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe	83
PID 5032 wrote to memory of 3980	5032	kyfuj.exe	94
PID 5032 wrote to memory of 3980	5032	kyfuj.exe	94
PID 5032 wrote to memory of 3980	5032	kyfuj.exe	94

C:\Users\Admin\AppData\Local\Temp\564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe
"C:\Users\Admin\AppData\Local\Temp\564be970d0121c7a5cc93e3360b9f1504aa85b334266589a9b836fbe9cc0ecd6N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\kyfuj.exe
  "C:\Users\Admin\AppData\Local\Temp\kyfuj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\goduh.exe
    "C:\Users\Admin\AppData\Local\Temp\goduh.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 8e2e4a8c69a7e0f5cee78ff9987123a641489b74db8da5022713b1f5ce4d67e6
MD5 0b2634fcc4a17eba4367606666da9587
SHA1 b2c522bdf58f915362bdbcd03739ec990d11b7dc
SHA512 8ae16972b4eb3fdf11384853f80fd102aae8c7f604e320b2fd610ce9b9a945bd1eb49af980e29d48c788999d26377b68ea8ae3f4254c4b497e54d6ef80d083f7
MD5 SHA1 SHA512

Submit Download

goduh.exe

Path C:\Users\Admin\AppData\Local\Temp\goduh.exe
Size 172KB
SHA256 2905d271ad0478cd53d2c7a49489a4fcc8d608effbba112e4d0918cd8596c24a
MD5 372b4cbcf5775a85d098b3ec3827a26a
SHA1 ca884a82fe62c43a7b05d9e91c7d838aaa562b46
SHA512 69cec8f346147f76e49f9f9439f0463b68e637c0ba6fa45a7665e7894d11da763003f6513f6a6188d497259ef9c4219029a98c7c78f0f91d93d8f6a476cf4455
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif0:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5fef29206de589dab027f177cc872bdb9ccc1d6a29a9e3bce1888f400a6a70c3
MD5 45248678a21d20fc248057c679798df0
SHA1 47322848c1254be2ec0aac2bc9b385a07d3763a6
SHA512 19feba3250a5d7772ab477830e8c46a27a1773055d6812c33753a8c45be753e4505df8ee3c0ef9ef727678f25202467239cbd39f7a90da7749e61963c36a0dea
MD5 SHA1 SHA512

Submit Download

kyfuj.exe

Path C:\Users\Admin\AppData\Local\Temp\kyfuj.exe
Size 331KB
SHA256 4a316dc3248ca75be29aa7bbce1f519f7607c03c6644a04ba571cf98fe3609f2
MD5 50f156e7154e887538831b9ed38d74a9
SHA1 b03db8ac77385e74aa021a34aeb48332bab947b3
SHA512 a6f7649bed2fbc6c406b7ba42ab3c2724dcd5fdd76b5091ac1a5cee2d7a8b0721c270036150e0e525da5bab04a3a2fa6744c114d21476f6647ff7567842097e1
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYHI:vHW138/iXWlK885rKlGSekcj66ciR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3980-46-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3980-45-0x0000000000770000-0x0000000000772000-memory.dmp

Download

memory/3980-37-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3980-38-0x0000000000770000-0x0000000000772000-memory.dmp

Download

memory/3980-40-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/3980-44-0x00000000000C0000-0x0000000000159000-memory.dmp

Download

memory/4616-17-0x0000000000DA0000-0x0000000000E21000-memory.dmp

Download

memory/4616-1-0x0000000001450000-0x0000000001451000-memory.dmp

Download

memory/4616-0-0x0000000000DA0000-0x0000000000E21000-memory.dmp

Download

memory/5032-20-0x0000000000F10000-0x0000000000F91000-memory.dmp

Download

memory/5032-39-0x0000000000F10000-0x0000000000F91000-memory.dmp

Download

memory/5032-13-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/5032-11-0x0000000000F10000-0x0000000000F91000-memory.dmp

Download