urelas | 4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe
Size 330KB
Sample241019-mszzwatfnn
SHA256 4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea
MD5 9ef1fa025984f1809c6e2b50323203b0
SHA1 8dc7817731dd61874c7c559ebcd141d507066ff5
SHA512 3ea3c64ce303f8410bc05ec58f3bc2b5c99281d20d3899098c1d1266ded626152de51e586dea272e6df0f3b3c7d180675b46124672d90671aa42d2d1acc9edb4
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYq:vHW138/iXWlK885rKlGSekcj66civ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165
218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	ucxyg.exe

Executes dropped EXE 2 IoCs

pid	Process
5036	ucxyg.exe
3484	begah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ucxyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	begah.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe
3484	begah.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 5036	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	87
PID 1220 wrote to memory of 5036	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	87
PID 1220 wrote to memory of 5036	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	87
PID 1220 wrote to memory of 1448	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	88
PID 1220 wrote to memory of 1448	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	88
PID 1220 wrote to memory of 1448	1220	4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe	88
PID 5036 wrote to memory of 3484	5036	ucxyg.exe	109
PID 5036 wrote to memory of 3484	5036	ucxyg.exe	109
PID 5036 wrote to memory of 3484	5036	ucxyg.exe	109

C:\Users\Admin\AppData\Local\Temp\4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe
"C:\Users\Admin\AppData\Local\Temp\4cba7ca7ea7812ea7715d1307891c57b554d7a7152478af307ec295e253c57ea.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\ucxyg.exe
  "C:\Users\Admin\AppData\Local\Temp\ucxyg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\begah.exe
    "C:\Users\Admin\AppData\Local\Temp\begah.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 340B
SHA256 3d75b0030c33359f6484f8822725cbc0d10dc5867e28f307b70c840bd8a46fea
MD5 a2abbf962ec82e46065d4c5e7cfe82de
SHA1 d370e873e57d2fba79b861eee1d277c0493aee86
SHA512 dc16fbe345906ea0064f6d292e425533f0f69135d076da0b59c3cef3e7f3520e873ddd0cb2e7bf5abdde24465a09484faab8556340ce3601b3f78cdb7e665237
MD5 SHA1 SHA512

Submit Download

begah.exe

Path C:\Users\Admin\AppData\Local\Temp\begah.exe
Size 172KB
SHA256 7ef63c5946354331b39cc7cb191024396cff12f44dafb5a7c48aafc655a01dc9
MD5 46d6966136775965eb30f4c144c2885f
SHA1 8ac28e5c6c1b089af681e28c881f1ad69e779417
SHA512 d8cec70c770abd9e328cb7bb9a723eb1bab72aee7788d1e8ad71350ada195338c037d8f21f7ceb2b7f66584cbb8c7b4e49401f03501c97bf8458a8cdb17b0f36
SSDEEP 3072:h5UQyDxxOY3b2iyLwYJsHt7QZGhmWwibhqOr1bzQjcgBsjdH5zTNoUUXGifO:h5QDxxxJNOGwWwQswtzQjdBOd5zTNsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 912556ea1b270b382533a8881ac6490d773e78e1832b8e7f980ccb4fd25fba10
MD5 9735d9859602d64a5b8d0a402bcbec27
SHA1 295fce3be6a90837a4d9e7bf14d5b255e11e1c6c
SHA512 5bf9fbf7cbef99f90b2fe0109114b25350cd54f477c111ad141b5d41e7fdf86b964b8befe0a226bf38a37d2d55a307b46a73d29cf846c54d67e4accd6de83e84
MD5 SHA1 SHA512

Submit Download

ucxyg.exe

Path C:\Users\Admin\AppData\Local\Temp\ucxyg.exe
Size 330KB
SHA256 4877a0c05fb2dbd3cebd417a50ea1f2a3f0fc15e5ce619418c81508c0a1db94b
MD5 5a758126b876f90ba7fbdf468d8297cd
SHA1 3f2cd76cb9dfe78eb0c23aa21f39788042695b28
SHA512 fcf8989bdeda2e02463c7fea467ab15c9f906247222690e3fd79040733cfd9643ad09a2c08e1560146f6ca1abec1d66e0f42807f235ee183b3442953654e0c99
SSDEEP 6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYY:vHW138/iXWlK885rKlGSekcj66ciB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-17-0x0000000000420000-0x00000000004A1000-memory.dmp

Download

memory/1220-1-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/1220-0-0x0000000000420000-0x00000000004A1000-memory.dmp

Download

memory/3484-41-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-42-0x00000000005F0000-0x00000000005F2000-memory.dmp

Download

memory/3484-38-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-45-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-46-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-47-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-48-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/3484-49-0x0000000000AE0000-0x0000000000B79000-memory.dmp

Download

memory/5036-20-0x0000000000460000-0x00000000004E1000-memory.dmp

Download

memory/5036-21-0x0000000000450000-0x0000000000451000-memory.dmp

Download

memory/5036-13-0x0000000000460000-0x00000000004E1000-memory.dmp

Download

memory/5036-43-0x0000000000460000-0x00000000004E1000-memory.dmp

Download

memory/5036-14-0x0000000000450000-0x0000000000451000-memory.dmp

Download