urelas | 5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe
Size 332KB
Sample241007-p8h3eazfrc
SHA256 5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01
MD5 736d0984e1553392140d30fb6d087730
SHA1 52c487cf97556c7be469f3bd09795616ed4068f8
SHA512 3ba35bb9a015da7d938fba4bd47b2c68324d8d1dd49875dcce5d9fa54ee3170d37e7300d519dfd1065b5415b0d6ace01d9840f2d4ca22750f07a37be33d3107b
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYD:vHW138/iXWlK885rKlGSekcj66cii
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	gumyl.exe

Executes dropped EXE 2 IoCs

pid	Process
2612	gumyl.exe
3200	sygov.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gumyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sygov.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe
3200	sygov.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 2612	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	84
PID 3196 wrote to memory of 2612	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	84
PID 3196 wrote to memory of 2612	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	84
PID 3196 wrote to memory of 4760	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	85
PID 3196 wrote to memory of 4760	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	85
PID 3196 wrote to memory of 4760	3196	5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe	85
PID 2612 wrote to memory of 3200	2612	gumyl.exe	88
PID 2612 wrote to memory of 3200	2612	gumyl.exe	88
PID 2612 wrote to memory of 3200	2612	gumyl.exe	88

C:\Users\Admin\AppData\Local\Temp\5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe
"C:\Users\Admin\AppData\Local\Temp\5b6cdf869ba371bdf9f4b449a658507bde4c6aadaabe4fc65df106c473ef2c01N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\gumyl.exe
  "C:\Users\Admin\AppData\Local\Temp\gumyl.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\sygov.exe
    "C:\Users\Admin\AppData\Local\Temp\sygov.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 2c241f2176434dcba6fe65d39fdbb4ab1b96d7d88d30b953436acc048405d8b0
MD5 cc4a03ef659bc58c63a71aef862cf701
SHA1 370c348f9d352254bff715b4c5c56dfe4b9eb537
SHA512 de9a82911b6837a274601168c02495fab1b767fd0c196e8ad2f644017f87855ad22e11923722e31836326c1f242cb39ae4e5bf9148517ca21ae61d6e2c671851
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 649a318093eeb5b20c1a7db97f58c5f3aba95305a01390b6095e5a9a54e85e7c
MD5 11ca1eaa56a80ae79ff8f463c69b963c
SHA1 03335ca4801c060548070ec0a6a17628e2063e71
SHA512 560b9640a5912887819119832ee46b0c6ee0d8d0736d9d0a852d130a1b28d02edd6290f544c9958a588fa452151bba1c6a12a522365c83b6e870c216f67afab3
MD5 SHA1 SHA512

Submit Download

gumyl.exe

Path C:\Users\Admin\AppData\Local\Temp\gumyl.exe
Size 332KB
SHA256 9b84bc990c1ef4e16eac8ffe813f22f838f1bd9c58c89e76a377b03aeb761758
MD5 f2f35adf27734f3a8a5d2da88db7321d
SHA1 d483924246f28f349675c662c7f6e159ab55744e
SHA512 4c6ccfaee0f1585651ede256fe8c2b0213f9ba14a46362f8a291cde52e173268aa460fcf7e0e13488f186f2a905757a07276fd7d6a7ef1f47234ab8bac2b8ebc
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYh:vHW138/iXWlK885rKlGSekcj66ciw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sygov.exe

Path C:\Users\Admin\AppData\Local\Temp\sygov.exe
Size 172KB
SHA256 526b6af3b49b58afd791278d12767b885dc8e8f55356fb824ff917d6d4b65ced
MD5 8a17984ff4f3434c1c3104467be58f42
SHA1 2dbbf18911cddc323391182b02d7a8ea098ea2e3
SHA512 68ae5ba4e2ce9c1f258348144a0f51ec67ad56ab5d175af061abf54dad3ab72a3964652800ef1e7650bf2f58e74a3832a9925e95622ec207d380b5734256c1bf
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif/:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2612-20-0x0000000000810000-0x0000000000891000-memory.dmp

Download

memory/2612-21-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/2612-14-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/2612-13-0x0000000000810000-0x0000000000891000-memory.dmp

Download

memory/2612-39-0x0000000000810000-0x0000000000891000-memory.dmp

Download

memory/3196-0-0x0000000000DE0000-0x0000000000E61000-memory.dmp

Download

memory/3196-1-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/3196-17-0x0000000000DE0000-0x0000000000E61000-memory.dmp

Download

memory/3200-41-0x0000000000B10000-0x0000000000BA9000-memory.dmp

Download

memory/3200-40-0x0000000000A70000-0x0000000000A72000-memory.dmp

Download

memory/3200-42-0x0000000000B10000-0x0000000000BA9000-memory.dmp

Download

memory/3200-46-0x0000000000A70000-0x0000000000A72000-memory.dmp

Download

memory/3200-47-0x0000000000B10000-0x0000000000BA9000-memory.dmp

Download

memory/3200-48-0x0000000000B10000-0x0000000000BA9000-memory.dmp

Download