urelas | c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002

Analysis

max time kernel
119s
max time network
78s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe
Size 327KB
Sample241010-akyqmasblf
SHA256 c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002
MD5 211ca5040fdd16288a52a51b0c1f6e60
SHA1 15d55a233fad1c16078b5eface941e188a8e0f17
SHA512 93dd629d9bb8ceedc17d9d6b3a776a8903d7be6d3660e29a3084586bab7e25c86c4ab95d5ee6ac0b073e09e2e90b4d2121f7f47ac8e2606da77f6a8e61215819
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOs:vHW138/iXWlK885rKlGSekcj66cin
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2240	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1824	ruvuj.exe
3008	hoxib.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe
1824	ruvuj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hoxib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ruvuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe
3008	hoxib.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1824	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	30
PID 2168 wrote to memory of 1824	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	30
PID 2168 wrote to memory of 1824	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	30
PID 2168 wrote to memory of 1824	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	30
PID 2168 wrote to memory of 2240	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	31
PID 2168 wrote to memory of 2240	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	31
PID 2168 wrote to memory of 2240	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	31
PID 2168 wrote to memory of 2240	2168	c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe	31
PID 1824 wrote to memory of 3008	1824	ruvuj.exe	34
PID 1824 wrote to memory of 3008	1824	ruvuj.exe	34
PID 1824 wrote to memory of 3008	1824	ruvuj.exe	34
PID 1824 wrote to memory of 3008	1824	ruvuj.exe	34

C:\Users\Admin\AppData\Local\Temp\c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe
"C:\Users\Admin\AppData\Local\Temp\c33a5ff32a21f5caa615f5675a2106f565400e177273ee5af113c2cdfe765002N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\ruvuj.exe
  "C:\Users\Admin\AppData\Local\Temp\ruvuj.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\hoxib.exe
    "C:\Users\Admin\AppData\Local\Temp\hoxib.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 b5540356d410b430d518472dbbfab405deb8a5d6899a175e481567f9bb67a216
MD5 0724ffceef07fee872724738577bcf31
SHA1 f356ffa6edaf7df7c94346713a9da4331d0afa4b
SHA512 03ec26b0757ae6cd4f80f85e2c901a2af386467aaee152c1eac210212fcde3c5de3c7e1609080d88ed1a2b2d32c9aaf37a126f3e64614d530dc7e64ca2f70522
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b38c6f2917fc1142c59e967d5def46fd5551de01b5cfaf640a5eb2d7bf4e2f3f
MD5 04eff1da14f48809e43f1ece015b1c8c
SHA1 b04376b3699a0eabf6b88385b274d2a761b76bed
SHA512 34577dc0edcb3a75f5dc930f241786d2eba3abea480436470dcef739961b4faeefd7aa7b41ac88578b9762e6f28c7cb323452b1bf50b4ac3b1247edb3b66c58a
MD5 SHA1 SHA512

Submit Download

hoxib.exe

Path C:\Users\Admin\AppData\Local\Temp\hoxib.exe
Size 172KB
SHA256 59fb44e298f490d98ea49cd7c6e21da95600762e62f56d2c57eeaa8234e11465
MD5 18f745d0a6fa037db7637b2b6d266234
SHA1 6c944685d43a38bdce8bcb83caf7e7899887791e
SHA512 dc35b7a85f825df42dde4276df8302b528d972200971850d315a2afe2b016d93ae35de59faf7816fa5e045770ee56e9636c2aa3be6d2254124b7002e64873a43
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifG:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ruvuj.exe

Path \Users\Admin\AppData\Local\Temp\ruvuj.exe
Size 327KB
SHA256 08d6d2de7497ae6724657e15a5acbd9c66e775bda81e5773f1611ea88bd7617d
MD5 21e0df4ad940c678813fb58e95272cc1
SHA1 b6dc12aa329e7d338176bdf7684bb5ec9b2f0655
SHA512 cd9fd414082e6b4024a6902818f8953e825e2bd1878dbd28d22a69b3f62214398e042140ca84f7c980006765cddef2a324ccb575675d86f5be0517504f6b3da8
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMO9:vHW138/iXWlK885rKlGSekcj66ciS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1824-41-0x0000000000160000-0x00000000001E1000-memory.dmp

Download

memory/1824-12-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1824-11-0x0000000000160000-0x00000000001E1000-memory.dmp

Download

memory/1824-24-0x0000000000160000-0x00000000001E1000-memory.dmp

Download

memory/1824-37-0x0000000003550000-0x00000000035E9000-memory.dmp

Download

memory/2168-1-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2168-0-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Download

memory/2168-21-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Download

memory/2168-7-0x0000000000BE0000-0x0000000000C61000-memory.dmp

Download

memory/3008-42-0x0000000000DE0000-0x0000000000E79000-memory.dmp

Download

memory/3008-45-0x0000000000DE0000-0x0000000000E79000-memory.dmp

Download

memory/3008-47-0x0000000000DE0000-0x0000000000E79000-memory.dmp

Download

memory/3008-48-0x0000000000DE0000-0x0000000000E79000-memory.dmp

Download