urelas | ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/10/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe
Size

330KB
MD5

2dd959c6e1effb6abe46f94d0702b2f5
SHA1

77b2edad9d60e05a74840a598a7797e47c42a885
SHA256

ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43
SHA512

ac666070e68302e8092b1a180f69ae71c808a75b99813e7c2c55d26bc7fc007ef7724ce616a8652565bf78c71011bac6f04b2b628a1f7a6d559ff5b9314ae1a7
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVN:vHW138/iXWlK885rKlGSekcj66ciEN

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2792	ulivd.exe
1664	xibyn.exe

Loads dropped DLL 2 IoCs

pid	Process
1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe
2792	ulivd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xibyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulivd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe
1664	xibyn.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2792	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	31
PID 1904 wrote to memory of 2792	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	31
PID 1904 wrote to memory of 2792	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	31
PID 1904 wrote to memory of 2792	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	31
PID 1904 wrote to memory of 2692	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	32
PID 1904 wrote to memory of 2692	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	32
PID 1904 wrote to memory of 2692	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	32
PID 1904 wrote to memory of 2692	1904	ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe	32
PID 2792 wrote to memory of 1664	2792	ulivd.exe	34
PID 2792 wrote to memory of 1664	2792	ulivd.exe	34
PID 2792 wrote to memory of 1664	2792	ulivd.exe	34
PID 2792 wrote to memory of 1664	2792	ulivd.exe	34

C:\Users\Admin\AppData\Local\Temp\ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe
"C:\Users\Admin\AppData\Local\Temp\ad9a72ffd516fe8bc888115cf1beda8cac2c8f17d5a0a82351bad1ccf517cc43.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\ulivd.exe
  "C:\Users\Admin\AppData\Local\Temp\ulivd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\xibyn.exe
    "C:\Users\Admin\AppData\Local\Temp\xibyn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
23711745137f60f536ecd30106ce5d6f

SHA1
bedbfff2c9fbc138a78a3d1c0bde391a363d6c97

SHA256
f9416d13ebeddc0f2f679e8cfe904d11dc2b36f18caed57b4bb8aaca87af34ac

SHA512
97777e6997e64424650f83ad22a7c2bd553e9f6d021602853c182c81646d956c87c65fc20ec05e28669a55acce5a4736e523dbbc2c74852ad9d3c5b4494d6482

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
30534a7deebc139a411c526b15aa8991

SHA1
b8e22af170a474f68c5453b3694a701520326b0b

SHA256
10ae025bd6dbbee90cb2bcb56b8da9c439b72e281e4ca82d12c6b9766c77fc7c

SHA512
8b77cb2a6581894ce1084757122311f5b9f2dd2831a40adfd0fbf0144a3831b58e6b8c10994e64857f0541e135e51691656efc70f131ba00110f977a3cbb90ac

Download Submit
\Users\Admin\AppData\Local\Temp\ulivd.exe

Filesize
330KB

MD5
eee883e21589528c41d9062c59e56ae0

SHA1
bfc2c95ffb57e167735c32617f339cee2fa9b2e7

SHA256
47241c195a28576c26dc90222fdc925064b19654606073466d2dbbed6284e11e

SHA512
248483b8fccceff6e2a2b687a4ef01f64116e470ba8aa8612be2538372972040f07a1df53e1284c6d883b82c701c682ba505822890198f255448006846c412cd

Download Submit
\Users\Admin\AppData\Local\Temp\xibyn.exe

Filesize
172KB

MD5
0f92b5789319c1f0f64956c0edc285f8

SHA1
9bda7da7403f42a46a5ffbe5564a21b5f3d7a4f9

SHA256
08b1c97dd6b1b2365caf960dce6242d1d30ba75e72621742eaa28f48d41dd4bb

SHA512
aea9a18f17af9c3963b25fc62dbee99232f400618a3df11b958519bf00017b1fe6a3223962a8c1a50c75f0d8101fb4630cbe9e6087f3c4abd7f9f64bcbf2d842

Download Submit
memory/1664-47-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-51-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-50-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-43-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-42-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-49-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1664-48-0x0000000000C90000-0x0000000000D29000-memory.dmp

Filesize
612KB

Download
memory/1904-0-0x0000000000240000-0x00000000002C1000-memory.dmp

Filesize
516KB

Download
memory/1904-9-0x0000000002B50000-0x0000000002BD1000-memory.dmp

Filesize
516KB

Download
memory/1904-21-0x0000000000240000-0x00000000002C1000-memory.dmp

Filesize
516KB

Download
memory/1904-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2792-18-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2792-40-0x0000000000980000-0x0000000000A01000-memory.dmp

Filesize
516KB

Download
memory/2792-41-0x0000000003D00000-0x0000000003D99000-memory.dmp

Filesize
612KB

Download
memory/2792-24-0x0000000000980000-0x0000000000A01000-memory.dmp

Filesize
516KB

Download
memory/2792-12-0x0000000000980000-0x0000000000A01000-memory.dmp

Filesize
516KB

Download