urelas | 918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170

Analysis

max time kernel
119s
max time network
77s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe
Size 331KB
Sample241007-nsevdaxbpc
SHA256 918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170
MD5 6f0b20cc70a8e5660eda445add8b1450
SHA1 a1df7785e3e8dac04213107513f728e157cb6768
SHA512 ca8e4544cd38bb5ee4d61fb8011cd0b628c5e7a201d2ae357096dd52007bcc27f6eecbff0ac48f457e8fbfa2b3ecc1472df22bbecb7db557502532a50996903a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVg:vHW138/iXWlK885rKlGSekcj66ciEg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2948	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2308	xesol.exe
2656	koqek.exe

Loads dropped DLL 2 IoCs

pid	Process
2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe
2308	xesol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xesol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	koqek.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe
2656	koqek.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2308	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	30
PID 2516 wrote to memory of 2308	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	30
PID 2516 wrote to memory of 2308	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	30
PID 2516 wrote to memory of 2308	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	30
PID 2516 wrote to memory of 2948	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	31
PID 2516 wrote to memory of 2948	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	31
PID 2516 wrote to memory of 2948	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	31
PID 2516 wrote to memory of 2948	2516	918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe	31
PID 2308 wrote to memory of 2656	2308	xesol.exe	34
PID 2308 wrote to memory of 2656	2308	xesol.exe	34
PID 2308 wrote to memory of 2656	2308	xesol.exe	34
PID 2308 wrote to memory of 2656	2308	xesol.exe	34

C:\Users\Admin\AppData\Local\Temp\918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe
"C:\Users\Admin\AppData\Local\Temp\918d079c8e3477fac8ed1a86287f4a2434f228ad7555afe8485618edcd7dc170N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\xesol.exe
  "C:\Users\Admin\AppData\Local\Temp\xesol.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\koqek.exe
    "C:\Users\Admin\AppData\Local\Temp\koqek.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 4fcccbdbf1222ebe99b4c127304aef73b0ce95ecd6b25453b6dc2a75de33a30a
MD5 398b693664e2956c2bc3e3f798674b61
SHA1 ba41c38c2976a65c6ec5b3c45e74255daf254ea1
SHA512 b4fb040828ad6c4d1d1dd3cbd6d36b2d533dccb00e9a1327663877f08b692a76eb8b311be5fad9aa0b64867504bba56f16cb085602f74f26c61b14ec1f019776
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 81cb67b0f9745b7a32adb23a60f6b020f3cde46d78e96c6f4d1c514803e5414f
MD5 6c8867c6d004cc6129be924cb341f24a
SHA1 26893779e5380772f3a90f279223fc2a34695e6e
SHA512 7cd8e3f411809ead4b9f5044cca6b88cc1dac9cf56d6ac654c55ade930ef4de9be80beb72adaa4c8d113f6a9708d9ea49f9c5306c4fcc04560d9c5735b1d2e75
MD5 SHA1 SHA512

Submit Download

koqek.exe

Path \Users\Admin\AppData\Local\Temp\koqek.exe
Size 172KB
SHA256 6dcc5e571c76bb93d53f8754baa77c82a549de30619286a4fbe11ccbcf4641b8
MD5 9bc7720d6b54d7045784a2780efdc274
SHA1 2a4a270ff1300090d15e940f03e7a02bd306a7a0
SHA512 2ccc403b0c1a86a30472d2dc3ffa87d047029b6b586da83d5b89bf581cd9e02ae19a2954b4d24b003e0337727aacde9268fb8f6a68c41300379a98f20b510159
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifU:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xesol.exe

Path \Users\Admin\AppData\Local\Temp\xesol.exe
Size 331KB
SHA256 e46a437cb6c90d95934d2bd8389e1bff85ea08f3cd97bfad568f78168f9f2933
MD5 0d0f2d39a81520cd78ccfdc82c5bd441
SHA1 1a220bcc2038c814c30e2bcbd743b091bc5070b0
SHA512 ed32d7c8ff18d8068ab72c10e0610805321f97d97f954fe2b20d1dcee4940c9bd6af1e5eb22c2048233b14a1519a286f8ac5b79d72ea744018905f1daed5cf7b
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVS:vHW138/iXWlK885rKlGSekcj66ciES
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2308-25-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2308-18-0x0000000000D80000-0x0000000000E01000-memory.dmp

Download

memory/2308-21-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2308-24-0x0000000000D80000-0x0000000000E01000-memory.dmp

Download

memory/2308-38-0x0000000002CE0000-0x0000000002D79000-memory.dmp

Download

memory/2308-42-0x0000000000D80000-0x0000000000E01000-memory.dmp

Download

memory/2516-20-0x0000000000F40000-0x0000000000FC1000-memory.dmp

Download

memory/2516-0-0x0000000000F40000-0x0000000000FC1000-memory.dmp

Download

memory/2516-9-0x0000000002530000-0x00000000025B1000-memory.dmp

Download

memory/2516-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2656-43-0x00000000010F0000-0x0000000001189000-memory.dmp

Download

memory/2656-47-0x00000000010F0000-0x0000000001189000-memory.dmp

Download

memory/2656-48-0x00000000010F0000-0x0000000001189000-memory.dmp

Download