urelas | b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2024, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe
Size 327KB
Sample241016-qthzjasanc
SHA256 b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8
MD5 53a7b71b884682e9e207ef306f6aed30
SHA1 106f5bb08d8ecbdc9d790fa95e95bcad79d55b9e
SHA512 ae137a66abe590c3497d330bd1de5a9230b41acc454c1d3bf0537d90a8b2ed114385904cb540148aa0ddf6fbed4f488a91bd6388352eb1b6060403af80112537
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOM:vHW138/iXWlK885rKlGSekcj66ciL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	bovoi.exe

Executes dropped EXE 2 IoCs

pid	Process
3240	bovoi.exe
2052	liwii.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bovoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	liwii.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe
2052	liwii.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3240	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	89
PID 4752 wrote to memory of 3240	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	89
PID 4752 wrote to memory of 3240	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	89
PID 4752 wrote to memory of 1704	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	90
PID 4752 wrote to memory of 1704	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	90
PID 4752 wrote to memory of 1704	4752	b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe	90
PID 3240 wrote to memory of 2052	3240	bovoi.exe	106
PID 3240 wrote to memory of 2052	3240	bovoi.exe	106
PID 3240 wrote to memory of 2052	3240	bovoi.exe	106

C:\Users\Admin\AppData\Local\Temp\b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe
"C:\Users\Admin\AppData\Local\Temp\b82f137eb06547d05186d7a767b5360bc32b3fc0129cef8c2a8593ea2159dfa8N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\bovoi.exe
  "C:\Users\Admin\AppData\Local\Temp\bovoi.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Users\Admin\AppData\Local\Temp\liwii.exe
    "C:\Users\Admin\AppData\Local\Temp\liwii.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 342B
SHA256 5fe125eabae33170540d6c906c94c91a2c830a192646885d5e325817464123ad
MD5 2f9cecc3dcef7685aa783abfa08af999
SHA1 8a0583b25e723ea2e0891bb60db4a8a69fb15213
SHA512 c51ebe7ed710618d7e3841f45d4cbd7de8dfb318016258814c5d946677bdc97585b7c64c482b8f48df60badaf6c9a05310dd933bd416838106d0258c8a38e773
MD5 SHA1 SHA512

Submit Download

bovoi.exe

Path C:\Users\Admin\AppData\Local\Temp\bovoi.exe
Size 327KB
SHA256 715526681e5d9e5122231f9401bc2f740be1972fda3d9e3f193e4b6071065950
MD5 bb440920817ea20524ab0b2d73181fac
SHA1 4573e2c4286097e56f5761bad6e11711d95c0a07
SHA512 038950f34809f7c1c70df4cbcfae8c06cd647f25ed7ffff959756697200562fc9ce695fd0825b3d5b83cf21fe404b765d218669a47999d56935d25fc6a5851a6
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOS:vHW138/iXWlK885rKlGSekcj66cit
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 82304175aac4ce9e188090997baa97f727daafcf2850b93068dc745846eeb2f2
MD5 e3a0b85ee0a1b2dbeb66b85baa6f9b8b
SHA1 3679cd9642c6dea6a9489f6a37551c23b8fcce1d
SHA512 cfaccd31e0e193fb199e28b7bdce432000d1d41fc3793be4dddcd54a45beedd06257b594654dd3d01f2a6adb48427f44ab5380678cdd2257a6bd2ebe2ad987f2
MD5 SHA1 SHA512

Submit Download

liwii.exe

Path C:\Users\Admin\AppData\Local\Temp\liwii.exe
Size 172KB
SHA256 57b5ba6e4d49ffde191619b5ddeca9ccc6fa6933197834dcbfbeb2b66c9e00bb
MD5 4719d38ee453f94a2d41bf06988025b0
SHA1 74b7f1b1fee7443e1fcd62c83667d41858ca12e9
SHA512 b6f3d97dd24be658de77edc0d0c59a832e3c8744c5a914f6a53a01dfada2e383ac1220e735d0a43f1af4c62bd31aca5fe868d0de28744a78946ba586f02bb755
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifM:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2052-47-0x0000000000770000-0x0000000000809000-memory.dmp

Download

memory/2052-46-0x0000000000770000-0x0000000000809000-memory.dmp

Download

memory/2052-38-0x0000000000770000-0x0000000000809000-memory.dmp

Download

memory/2052-44-0x00000000003B0000-0x00000000003B2000-memory.dmp

Download

memory/2052-39-0x0000000000770000-0x0000000000809000-memory.dmp

Download

memory/3240-20-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/3240-21-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/3240-11-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/3240-43-0x0000000000AC0000-0x0000000000B41000-memory.dmp

Download

memory/3240-14-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/4752-0-0x0000000000C60000-0x0000000000CE1000-memory.dmp

Download

memory/4752-17-0x0000000000C60000-0x0000000000CE1000-memory.dmp

Download

memory/4752-1-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download