urelas | 5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe
Size 597KB
Sample241010-ngc7eazfmp
SHA256 5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675
MD5 f9c91e2058f13e0e9585a2f79eba4bf0
SHA1 913233de058e01f3d5a4240659d593c77d32e28d
SHA512 398326b16d86935d970d1cfccf38415dcf0cf2149c3f671fcca3fdd7769fb28dabbf5e0aa74c3ca550f3922423028c7826bc4c5152a678ee0af9f0cbe1bc1f64
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpB2:MU7MLb4BQkntwNjqdR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	bedyy.exe

Executes dropped EXE 2 IoCs

pid	Process
2856	bedyy.exe
944	roiqp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roiqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bedyy.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe
944	roiqp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2856	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	86
PID 4656 wrote to memory of 2856	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	86
PID 4656 wrote to memory of 2856	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	86
PID 4656 wrote to memory of 4128	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	87
PID 4656 wrote to memory of 4128	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	87
PID 4656 wrote to memory of 4128	4656	5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe	87
PID 2856 wrote to memory of 944	2856	bedyy.exe	94
PID 2856 wrote to memory of 944	2856	bedyy.exe	94
PID 2856 wrote to memory of 944	2856	bedyy.exe	94

C:\Users\Admin\AppData\Local\Temp\5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe
"C:\Users\Admin\AppData\Local\Temp\5e5d62964856f96d33a59d80c3a67832cc8b255bbfb975c2704a6c1594200675N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\bedyy.exe
  "C:\Users\Admin\AppData\Local\Temp\bedyy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\roiqp.exe
    "C:\Users\Admin\AppData\Local\Temp\roiqp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 7226f288cbca617c427e768467eccaa03b0cb0ebe1f0d0bbfd01a8344d056470
MD5 1af1d934239a03e2bbea2aa5de68d4ec
SHA1 869d38b8b25bbd4848edd3790aa54c33643f98b8
SHA512 2ae4a5d079ad498c75ea68e7a29a02529d5eda9d96f840e7d22134383d238a7f0997cbd79739bad7e4330ebf6053d869129dfba4f9972567d94713338370f7d0
MD5 SHA1 SHA512

Submit Download

bedyy.exe

Path C:\Users\Admin\AppData\Local\Temp\bedyy.exe
Size 597KB
SHA256 64d02fe70facc9894ef5e2c9b069ba845ad927e7153763e09ef8a665880b6920
MD5 2885cef7ac4bf0724ec4be30328ebbbe
SHA1 d43dce4cf1dfd73630f3bc4ed30a501cf68bd34c
SHA512 a191a117fe2ea98d7ff23ff042fe6310b51b1e9f4f7bbf5d79b931f0c097e16df353e702884acf4f4a940196257b2885fd884df301a7f3426255dcb0fefc859e
SSDEEP 6144:KzU7blKaPcbhj+bB7ktZeRnVDJm0oNjOPdInpB0:MU7MLb4BQkntwNjqdl
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8102b9d7cd5d23f2a81255baf4715dcb8fe8de5826da9758911af946a141c657
MD5 a6f3d48d2069d3dcef13732d36d91d7b
SHA1 67f59f4ee7b41f12d4c13f2ab4e73da3ca91f8ba
SHA512 39f2c0548c0ddf73ef0fdce3fdc7ff0701082d34a55e9789355dbf839e16f3140ac43b98795cc82a60ecb4e286c64ca64887ed7bc79141aeaf8cd2f129c8a4dd
MD5 SHA1 SHA512

Submit Download

roiqp.exe

Path C:\Users\Admin\AppData\Local\Temp\roiqp.exe
Size 211KB
SHA256 6b065a17b8dd1180bc49a078f7cdb0bc7dbbf81096678518e1ed03d49e60a4ae
MD5 461b5e1be8a1f265791cf668ec027b4b
SHA1 77979478064068f7b8c2743340bc7b5e407414a3
SHA512 bc3cbb5cdf1be0c66690696b4b73713e35b5f170776833acecae602e2c3b126e6532b4e3c5d62d94e0b888d9d930ff621dedc4db62368a9d7b70c9faac7e5527
SSDEEP 3072:9k2+LfWgO0xdH4Cjv+tcgBO3jKjOMFwEQIN3C9ISE0qJiNlUdpnlW:G2ngLdH4CHjKjOMFwEQISzqJBpnlW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/944-26-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/944-25-0x0000000000470000-0x0000000000521000-memory.dmp

Download

memory/944-30-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/944-29-0x0000000000470000-0x0000000000521000-memory.dmp

Download

memory/944-31-0x0000000000470000-0x0000000000521000-memory.dmp

Download

memory/2856-16-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/2856-27-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/4656-13-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/4656-0-0x0000000000400000-0x0000000000495000-memory.dmp

Download