urelas | 8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe
Size 331KB
Sample241012-n1w4matcll
SHA256 8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46b
MD5 37fe6876c0864c4b1603f415713a8a30
SHA1 4daf69b800cf5d258c9fcf511d61e4478f0242f9
SHA512 c0285bec719e1ae821fa88d50eb4447d315a36adf13dc48e288381a6f26c0603fb23005c15c7bad0a30c62ae7ced9f82ef0040ccb1f931a4e86347e33f543d4b
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYV7:vHW138/iXWlK885rKlGSekcj66ciE7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ujqoa.exe

Executes dropped EXE 2 IoCs

pid	Process
628	ujqoa.exe
5080	nuzuy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuzuy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujqoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe
5080	nuzuy.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 628	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	85
PID 404 wrote to memory of 628	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	85
PID 404 wrote to memory of 628	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	85
PID 404 wrote to memory of 4512	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	86
PID 404 wrote to memory of 4512	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	86
PID 404 wrote to memory of 4512	404	8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe	86
PID 628 wrote to memory of 5080	628	ujqoa.exe	91
PID 628 wrote to memory of 5080	628	ujqoa.exe	91
PID 628 wrote to memory of 5080	628	ujqoa.exe	91

C:\Users\Admin\AppData\Local\Temp\8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe
"C:\Users\Admin\AppData\Local\Temp\8a3cd75ba42ce6863d3d920c13490c65b54b03c50d499fc432230224938fc46bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\ujqoa.exe
  "C:\Users\Admin\AppData\Local\Temp\ujqoa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\nuzuy.exe
    "C:\Users\Admin\AppData\Local\Temp\nuzuy.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 e4aa4bb70edc5b78037c60a80aa48ebfba1e99a3c2ea382304509a81be74deb2
MD5 4f237e2fc86c1f1f2b92b627c68ffafb
SHA1 c0d7607700d7804b07de537051e7fe2ca95d3a3c
SHA512 4b7953774ceb9abf63175fe1c086733d7367b3ab471a7bd68bf0f82b6b856978aff19923b2f45a8aa42808a76157772e3baf6e95ff7bb33e148fb1e140d9c0f7
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5adfcb39a77b2361dbe9ef25811cc51f9ccd9f906fe6c7f162af09891336c78e
MD5 b66922e07df073c93a644e5ca075827f
SHA1 cac1cc430e92dd90eb355b97cbfd880b6d8b8171
SHA512 95ea7279f524e9d9550683b125b8d41c5cca8dcf03f7f7a0e7385c87981235a11b3161e9e995d07b6b4e59db963995b6f4e553816e663d6dc6bd4f2fd5eb45a0
MD5 SHA1 SHA512

Submit Download

nuzuy.exe

Path C:\Users\Admin\AppData\Local\Temp\nuzuy.exe
Size 172KB
SHA256 9314175d4bf7f3f56ff2b0380752942ce58a480e16915ffea70a6f03cc7fd37e
MD5 ca9b8f1aeb4ecb5a604f5a3bbf38fb59
SHA1 34395139279f52805df07434aca840821a29fb8b
SHA512 2b5b63074a651213a98223621f1986301834441a82ff0b2d4993d6294a29fc251db6e1594e8b465ce5400537ffd88b5b36504c3f924ed302c776908898a15220
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGif2:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ujqoa.exe

Path C:\Users\Admin\AppData\Local\Temp\ujqoa.exe
Size 331KB
SHA256 5c43d27da8d5361c7eb38180d428f94ce323ed0321231cc54ede12dba54015f4
MD5 e6d9541b402f61ca688a3a4cbbdc1ed1
SHA1 97e5971a7827a89e0b1a6a611c1ca13c9735b9cd
SHA512 9d88390bdc1d6f3c6e405a5581dd713649cfaecdcb47e258359ace15a5d94290ddf0a571dec73d240483e8b566a2b6c323a1b01654bede4b3f3fe91ac88508b0
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVW:vHW138/iXWlK885rKlGSekcj66ciEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-17-0x00000000001E0000-0x0000000000261000-memory.dmp

Download

memory/404-1-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/404-0-0x00000000001E0000-0x0000000000261000-memory.dmp

Download

memory/628-41-0x00000000000B0000-0x0000000000131000-memory.dmp

Download

memory/628-11-0x00000000000B0000-0x0000000000131000-memory.dmp

Download

memory/628-14-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/628-20-0x00000000000B0000-0x0000000000131000-memory.dmp

Download

memory/628-21-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/5080-38-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-39-0x00000000005F0000-0x00000000005F2000-memory.dmp

Download

memory/5080-42-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-47-0x00000000005F0000-0x00000000005F2000-memory.dmp

Download

memory/5080-46-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-48-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-49-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-50-0x00000000004F0000-0x0000000000589000-memory.dmp

Download

memory/5080-51-0x00000000004F0000-0x0000000000589000-memory.dmp

Download