urelas | ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6

Analysis

max time kernel
120s
max time network
95s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16/10/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe
Size 323KB
Sample241016-bb42qavblb
SHA256 ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6
MD5 e500ce29fc7e0c9e87a56711fbfe65d0
SHA1 5bec021ed99643cb2c4e3c0ce51e904d2382cbe8
SHA512 91912f6a7b336254f53f8e9e36f8d6baf7b4856a6b2732660b5726080ae0fce06dcce7cb5ff3e02d6cdaf795e49509f9595e262cdd40378ebee6ec2800833fe5
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY+:vHW138/iXWlK885rKlGSekcj66cib
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2796	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2760	yzohv.exe
2376	nudec.exe

Loads dropped DLL 2 IoCs

pid	Process
2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe
2760	yzohv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yzohv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nudec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe
2376	nudec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2760	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	30
PID 2872 wrote to memory of 2760	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	30
PID 2872 wrote to memory of 2760	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	30
PID 2872 wrote to memory of 2760	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	30
PID 2872 wrote to memory of 2796	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	31
PID 2872 wrote to memory of 2796	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	31
PID 2872 wrote to memory of 2796	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	31
PID 2872 wrote to memory of 2796	2872	ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe	31
PID 2760 wrote to memory of 2376	2760	yzohv.exe	34
PID 2760 wrote to memory of 2376	2760	yzohv.exe	34
PID 2760 wrote to memory of 2376	2760	yzohv.exe	34
PID 2760 wrote to memory of 2376	2760	yzohv.exe	34

C:\Users\Admin\AppData\Local\Temp\ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe
"C:\Users\Admin\AppData\Local\Temp\ab6691804969a4277076eaaa2527cc6aad60d15a7a2cd4e5153d13ac6e4362a6N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\yzohv.exe
  "C:\Users\Admin\AppData\Local\Temp\yzohv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\nudec.exe
    "C:\Users\Admin\AppData\Local\Temp\nudec.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 fce618f489c836cb117b82e3974f5c043e47d284c593bf5e2a5631a7bbc6eba1
MD5 d3633c59caffe7d13519c2cb317f1f04
SHA1 c8d3225b694b5e7de54efec38a16f1af7cff3f5b
SHA512 9b574bf3ac0d0ce04b802b0d42625196e883f09e2985ec3672a209225eb47873c64d349eda973a209219ae42a446ab2766413cb4426a4289d80938e2e8b1b5d0
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 2ce8bdf5683debec266db33c11702200aba1959c4cee8cdcbabb3f56da7c2afd
MD5 e76be354d078ddb9606bbebe9899c679
SHA1 d08f4c93ef3ceb55609b2abca51dc8492e559760
SHA512 0a76a50e81a7b4eb6698da2455c6431827193af39c3410b1d98adf321fd5e7c193e672a18d4440f5927613ce2b9a43eb6953248f965c8e13843231899260ed20
MD5 SHA1 SHA512

Submit Download

nudec.exe

Path \Users\Admin\AppData\Local\Temp\nudec.exe
Size 172KB
SHA256 7d5dffb46aa1ce7b74faf8bb42527b29870bd32f1eac37c77fba5cd3183bd354
MD5 0caeac4a62c939aaae723e25cb9ee051
SHA1 4098f27f0c4eff3d48d9fde4444a4b5e8215c874
SHA512 88d9efeab91521d8d387671a39d2642538927df960e4d2b3f31ec3fba22a0a6e279fc20ee34740ea78360c31f9de13377be93f60ebab05499b03ad108ed3124d
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGift4:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzohv.exe

Path \Users\Admin\AppData\Local\Temp\yzohv.exe
Size 323KB
SHA256 05414367b1e561932479049a792a929c71f8beca470a52a0c760834454ef958d
MD5 56409602f639f693a86c0828fcf49bd2
SHA1 4d6806c10f575a350fa9bca6e47fce0289e61e54
SHA512 6c0fe081502439b777627316dee82362d3c26d3d4d464c0fbdc6af4ae2d6bc4c0404fa6b21cf2501ee80e859a35f6861fff4feec7352f98a1c0834ff2e31603a
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYQ:vHW138/iXWlK885rKlGSekcj66cip
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2376-47-0x0000000000140000-0x00000000001D9000-memory.dmp

Download

memory/2376-46-0x0000000000140000-0x00000000001D9000-memory.dmp

Download

memory/2376-40-0x0000000000140000-0x00000000001D9000-memory.dmp

Download

memory/2376-42-0x0000000000140000-0x00000000001D9000-memory.dmp

Download

memory/2760-20-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Download

memory/2760-23-0x0000000000C30000-0x0000000000CB1000-memory.dmp

Download

memory/2760-36-0x0000000003260000-0x00000000032F9000-memory.dmp

Download

memory/2760-41-0x0000000000C30000-0x0000000000CB1000-memory.dmp

Download

memory/2760-11-0x0000000000C30000-0x0000000000CB1000-memory.dmp

Download

memory/2872-9-0x0000000002720000-0x00000000027A1000-memory.dmp

Download

memory/2872-19-0x0000000000C60000-0x0000000000CE1000-memory.dmp

Download

memory/2872-0-0x0000000000C60000-0x0000000000CE1000-memory.dmp

Download

memory/2872-1-0x0000000077BD0000-0x0000000077D79000-memory.dmp

Download