urelas | 6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20af

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe
Size 331KB
Sample241019-teaw6athmd
SHA256 6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20af
MD5 9fd6537818e61391607138374af578f0
SHA1 0d1cbc6e7e8adc370f2d39905eba9a6dd5b70fbd
SHA512 986c0471660ed5be9512cc7a87f726f70354fde4268fc41f4fcc1edba74c1a80d1a257a0741cef96e248e8db1c8999e3cb6d034af74ea1b53b8dcafbba9ca1be
SSDEEP 3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisG:Nd7rpL43btmQ58Z27zw39gY2FeZhmzr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas aspackv2 discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023c9f-31.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	awheyh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	reizb.exe

Executes dropped EXE 3 IoCs

pid	Process
1020	reizb.exe
2112	awheyh.exe
244	fezav.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reizb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	awheyh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fezav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe
244	fezav.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1020	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	85
PID 3620 wrote to memory of 1020	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	85
PID 3620 wrote to memory of 1020	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	85
PID 3620 wrote to memory of 4312	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	86
PID 3620 wrote to memory of 4312	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	86
PID 3620 wrote to memory of 4312	3620	6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe	86
PID 1020 wrote to memory of 2112	1020	reizb.exe	88
PID 1020 wrote to memory of 2112	1020	reizb.exe	88
PID 1020 wrote to memory of 2112	1020	reizb.exe	88
PID 2112 wrote to memory of 244	2112	awheyh.exe	111
PID 2112 wrote to memory of 244	2112	awheyh.exe	111
PID 2112 wrote to memory of 244	2112	awheyh.exe	111
PID 2112 wrote to memory of 2772	2112	awheyh.exe	112
PID 2112 wrote to memory of 2772	2112	awheyh.exe	112
PID 2112 wrote to memory of 2772	2112	awheyh.exe	112

C:\Users\Admin\AppData\Local\Temp\6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe
"C:\Users\Admin\AppData\Local\Temp\6802f9f362859b8a09160f8f3e6b5ba2f51784cc6e401988a97b1c479d1e20afN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\reizb.exe
  "C:\Users\Admin\AppData\Local\Temp\reizb.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Local\Temp\awheyh.exe
    "C:\Users\Admin\AppData\Local\Temp\awheyh.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\fezav.exe
      "C:\Users\Admin\AppData\Local\Temp\fezav.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 342B
SHA256 e2c50f2e8d7215b2afc969b4d0a81d140b4c4c255ec4b5bb8dd260cfc586a3ef
MD5 ca4a1efc7a2c911355dc2f0e2719cb68
SHA1 f0d23db9b9754cd31d6ff6377164ddc7229e27f6
SHA512 1a39440954d59bf2e73f23d817222f630a5da07afb94bda74484be69facec2c10a236d525599617c1de7b33987b80ef268552d12fcd4175b9feea1dcf8d5d387
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 38d7e237eb1ef6f9130d54053fef9c123c99496ad1b50a580c4e51d8eb790b5a
MD5 c77f02bd964eddab631a1e1df126564a
SHA1 9e793aaba44c3fc89b2cebfeec38f156f6e3f75b
SHA512 7be5950e9353b8ae8b0cd0da2205b9e182dffce513049ab42a3179f5cb9e9090bc7c4dc29d314383a41fa2cecab64e50e3db10968f621ab58c38b88ee29e5d17
MD5 SHA1 SHA512

Submit Download

fezav.exe

Path C:\Users\Admin\AppData\Local\Temp\fezav.exe
Size 136KB
SHA256 3e9b1bc25cb61cc45b97af30eb961a32eb21e9ee558567bbb772396220166f86
MD5 1d9ce4288d70ec8d21c17f971037e885
SHA1 9b94688ad0253c95a1b16832fd4a18c6a5f08d49
SHA512 9f777847b9f015316dfab932111678474d0e3b12d1911618da8dd4c6db24c77dd2028576b7adadfe3c6843ff07216bd2804a2d5a8463090167ebd070a923fbb6
SSDEEP 1536:jOgVPwzJWY1urHjjwJDxg0trb8jJzPnGC/s+BXLE+ptlf26WLpflZL:jRwkYQPwtxZMhPGClgWjSvZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 2866ee6eb56d39a826b031d9e0f0371becf3f1a4fd00b2f93deb18232748b672
MD5 3be5b9f24610bf35fe25115d78f14bf7
SHA1 8256c43bd3b342cd477fe2c69d8deb08a8f4464b
SHA512 f67d8ee52f1b0e28875130285bb15e806205d926f32b17be1bc95e9a07b1560936a80f8f306605285eff05653e485795705aedb4fd3f19c1c06de2fc484ff28a
MD5 SHA1 SHA512

Submit Download

reizb.exe

Path C:\Users\Admin\AppData\Local\Temp\reizb.exe
Size 331KB
SHA256 a234da01b1947abe12b9cb4ac55a6a8a340d688843b22f0ad31e6adf53bcf8d7
MD5 ecef46f97c154accc2637d03ea4e82f4
SHA1 29bb85e3a8b31bc96b6d6958ccd4a55838cee844
SHA512 f09f73a4558b7770b62cc8bc20aa501767acfebb04776bb20a1c2816dbb49af006a1de4e25f4a90c459cac04780019e1f1c3e71154aacdf6943fbeb9f5f2662a
SSDEEP 3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZis0:Nd7rpL43btmQ58Z27zw39gY2FeZhmz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/244-38-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-40-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-39-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-37-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-44-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-45-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/244-46-0x00000000003B0000-0x000000000043C000-memory.dmp

Download

memory/1020-23-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2112-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2112-42-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3620-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3620-15-0x0000000000400000-0x0000000000458000-memory.dmp

Download