urelas | b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1b

General

Target

b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Size

326KB
MD5

d4b7dbc86747362b43fc8a39a2d120c0
SHA1

80dac6c0814990e03dfe6e01ccb2b7922414d448
SHA256

b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1b
SHA512

d91831712d8f7f2eb9225bff1418dd603bceaf98379c2ba2d9fe006953c95d3fc466dbba7228374ffc5df0bea88cc5eab2f9567ea1373845d2b58c670bf0daea
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYP:vHW138/iXWlK885rKlGSekcj66ciG

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	popoq.exe

Executes dropped EXE 2 IoCs

pid	Process
2736	popoq.exe
684	wyzup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyzup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	popoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe
684	wyzup.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2736	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 5048 wrote to memory of 2736	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 5048 wrote to memory of 2736	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 5048 wrote to memory of 4060	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 5048 wrote to memory of 4060	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 5048 wrote to memory of 4060	5048	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 2736 wrote to memory of 684	2736	popoq.exe	106
PID 2736 wrote to memory of 684	2736	popoq.exe	106
PID 2736 wrote to memory of 684	2736	popoq.exe	106

C:\Users\Admin\AppData\Local\Temp\b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
"C:\Users\Admin\AppData\Local\Temp\b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\popoq.exe
  "C:\Users\Admin\AppData\Local\Temp\popoq.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\wyzup.exe
    "C:\Users\Admin\AppData\Local\Temp\wyzup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
4a69881de91e3435a5b4e53da38806f3

SHA1
a72bc6dc870f5b7766c296ec7fba8c5ff90d42b9

SHA256
7b600b50c865cf88f59ac574925c8310c42b09bead18858d089ba282d6286a2d

SHA512
eb210a4ea0e63d155b4d5fc122a6b8d9d7df056b5f93f98d0bce68ca89966d614570982fde0e8b00d059dbbaf1b57ce7e2b9b5bf497582e10431cad0e88efc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
aee5ff18353df1d11fe14d174f89e99f

SHA1
ac5cc8b4a8655363d4cd7c8276da8fc22fffbb98

SHA256
8cb1ea5c6d9adb0796389ff0c3d530bced07e8296fc55d272f514c5b40144f0c

SHA512
4427887cac5d3400d516a5e294e0a1fa371305cde6e0cad90e1a4ed8ee7e155bd1043a384b4d7f6eb9c65767d5d3c54bda20d2a5db8fd1e9249aaf3c53289988

Download Submit
C:\Users\Admin\AppData\Local\Temp\popoq.exe

Filesize
326KB

MD5
39a1efe3864600b5edf998c68997a0bc

SHA1
5fed6dd1b6cf8cc79eb4957281bac0d41003030a

SHA256
4eb38ff9b4d0307612a47ed28c38827e6b033e0ea00c909e7293498f7a9bd921

SHA512
c2ef39ea9c4ba03f476d507baed6b7cd13630e308307e4310020200e8c7fa06531e9f191c1a288ffe49e812dd4c63248060a80af640b98af495a5e2266dc54cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\wyzup.exe

Filesize
172KB

MD5
3c2f214c29d497a96ce86e194bc60f1e

SHA1
9863537d01876a193c5fd75c35a1aeb5be240431

SHA256
27eb9672b124a76c3f9b4385531dd68b2433ce8dbe94bbbffea2e61482aed478

SHA512
43942af7cc60f229edc33b41b163ea1ac96f61bb754e21f53bb9b256e992f83ab8f702d8e50d97e399f7d2935a4cc7da0a6637e24a9b1833ac5b472931742142

Download Submit
memory/684-48-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/684-47-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/684-46-0x0000000000A30000-0x0000000000A32000-memory.dmp

Filesize
8KB

Download
memory/684-38-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/684-39-0x0000000000A30000-0x0000000000A32000-memory.dmp

Filesize
8KB

Download
memory/684-40-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/2736-44-0x0000000000A50000-0x0000000000AD1000-memory.dmp

Filesize
516KB

Download
memory/2736-21-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2736-20-0x0000000000A50000-0x0000000000AD1000-memory.dmp

Filesize
516KB

Download
memory/2736-11-0x0000000000A50000-0x0000000000AD1000-memory.dmp

Filesize
516KB

Download
memory/2736-14-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/5048-0-0x00000000004B0000-0x0000000000531000-memory.dmp

Filesize
516KB

Download
memory/5048-17-0x00000000004B0000-0x0000000000531000-memory.dmp

Filesize
516KB

Download
memory/5048-1-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing