urelas | 74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe
Size 333KB
Sample241013-3prgbsshmf
SHA256 74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc
MD5 ea82ce3469ef3de8551168d21890befa
SHA1 70ebc82509ed3ce57dc9a9b12c0928e077c941c7
SHA512 dd3b31ea1506a50f684cd2d178811bb0b3c86f8e53911828c21f61785e3a772b14d7b9c975ba852c7c44d86f8420fe86b5abaa0206184db80d35b69bbeaa77b6
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYA:vHW138/iXWlK885rKlGSekcj66cil
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	tepij.exe

Executes dropped EXE 2 IoCs

pid	Process
2648	tepij.exe
3140	apkig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tepij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apkig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe
3140	apkig.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2648	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	86
PID 5020 wrote to memory of 2648	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	86
PID 5020 wrote to memory of 2648	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	86
PID 5020 wrote to memory of 384	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	87
PID 5020 wrote to memory of 384	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	87
PID 5020 wrote to memory of 384	5020	74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe	87
PID 2648 wrote to memory of 3140	2648	tepij.exe	94
PID 2648 wrote to memory of 3140	2648	tepij.exe	94
PID 2648 wrote to memory of 3140	2648	tepij.exe	94

C:\Users\Admin\AppData\Local\Temp\74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe
"C:\Users\Admin\AppData\Local\Temp\74371a348805697131a071ba0993ae57fbbb2e397a35d817ef9f904d61e666dc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\tepij.exe
  "C:\Users\Admin\AppData\Local\Temp\tepij.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\apkig.exe
    "C:\Users\Admin\AppData\Local\Temp\apkig.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 3a70f7f2a0cd7aecd1b3a0848c781619189eb152bd014e0146777b28f4692478
MD5 8390ca40cfaeae8d2a95426f9259689d
SHA1 cf91725781c4ae7dbcc0a445e7031f2a15d8ee74
SHA512 041bf25674b43df57e8c66410020622b2b8ff5cfe15005e43f0df66fb9e77a1ad0e39d8a59a38b8178cd3251fc471b2bcc0146742fab3d838ee951f299b07a22
MD5 SHA1 SHA512

Submit Download

apkig.exe

Path C:\Users\Admin\AppData\Local\Temp\apkig.exe
Size 172KB
SHA256 bb8667475a1d5512f00a5fc2fc71e44af49d5d9997df02aa4f6488b260e51b93
MD5 ce0b8bda6ce405537381069c3109f808
SHA1 0cc978488667cee7280031b8cef986f3e8d1b56c
SHA512 e0676e80e49f884c261d5aeb040cc56c5389993af20d8741b7791ef9b79674765199f2d8d7dfdb292173b143ece982bc31e0a0b34018ea0ddf7957c8cf5e58d5
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifV:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a185f1c35c7b678c36cc9d79b56a0417c861b095603ed3b44328f515c8100fd7
MD5 f02b734d4f9fd7ac00717cbb5ce2e7e3
SHA1 31d7b5fb096ac00c1a8a788d6f02054c047135bc
SHA512 1e5a445384d49d9e25892d27bf255a584b22ee563d8a5f836e551e18e2ecdc6f1c74487bf335c9862ffa59492d586055bad0559c5ca0b4f6428e33f4b9c65e7b
MD5 SHA1 SHA512

Submit Download

tepij.exe

Path C:\Users\Admin\AppData\Local\Temp\tepij.exe
Size 333KB
SHA256 7ba899a1740d06ffacb8a328568172f691d23e90dbe850298a9a081cb42fb5ab
MD5 55c25404dff7dac00f6e172a893a5242
SHA1 bdbecd316627bba2ed4b513bb1f109d616e65486
SHA512 2688c5cb0d1c48ab65083d33e5d62e8327c596ddd973ee5da7a711167b5ec3a30d5c32a466bd5518f529af5a1cf13e207995bc83ba8d56a5fea4c321db2779cd
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY+:vHW138/iXWlK885rKlGSekcj66cir
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2648-21-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/2648-44-0x0000000000520000-0x00000000005A1000-memory.dmp

Download

memory/2648-13-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/2648-12-0x0000000000520000-0x00000000005A1000-memory.dmp

Download

memory/2648-20-0x0000000000520000-0x00000000005A1000-memory.dmp

Download

memory/3140-46-0x0000000000D70000-0x0000000000D72000-memory.dmp

Download

memory/3140-39-0x0000000000D70000-0x0000000000D72000-memory.dmp

Download

memory/3140-40-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-38-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-47-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-48-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-49-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-50-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/3140-51-0x0000000000CD0000-0x0000000000D69000-memory.dmp

Download

memory/5020-17-0x0000000000460000-0x00000000004E1000-memory.dmp

Download

memory/5020-1-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/5020-0-0x0000000000460000-0x00000000004E1000-memory.dmp

Download