urelas | b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Size

326KB
MD5

d4b7dbc86747362b43fc8a39a2d120c0
SHA1

80dac6c0814990e03dfe6e01ccb2b7922414d448
SHA256

b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1b
SHA512

d91831712d8f7f2eb9225bff1418dd603bceaf98379c2ba2d9fe006953c95d3fc466dbba7228374ffc5df0bea88cc5eab2f9567ea1373845d2b58c670bf0daea
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYP:vHW138/iXWlK885rKlGSekcj66ciG

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	igkoi.exe

Executes dropped EXE 2 IoCs

pid	Process
4268	igkoi.exe
3720	ylcef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igkoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ylcef.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe
3720	ylcef.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4268	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 3784 wrote to memory of 4268	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 3784 wrote to memory of 4268	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	88
PID 3784 wrote to memory of 4720	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 3784 wrote to memory of 4720	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 3784 wrote to memory of 4720	3784	b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe	89
PID 4268 wrote to memory of 3720	4268	igkoi.exe	106
PID 4268 wrote to memory of 3720	4268	igkoi.exe	106
PID 4268 wrote to memory of 3720	4268	igkoi.exe	106

C:\Users\Admin\AppData\Local\Temp\b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe
"C:\Users\Admin\AppData\Local\Temp\b9b941340d2f6567cc3b1cabc1ce7c6b20eaf5dff660118c3882975a4f813e1bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\igkoi.exe
  "C:\Users\Admin\AppData\Local\Temp\igkoi.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Users\Admin\AppData\Local\Temp\ylcef.exe
    "C:\Users\Admin\AppData\Local\Temp\ylcef.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
4a69881de91e3435a5b4e53da38806f3

SHA1
a72bc6dc870f5b7766c296ec7fba8c5ff90d42b9

SHA256
7b600b50c865cf88f59ac574925c8310c42b09bead18858d089ba282d6286a2d

SHA512
eb210a4ea0e63d155b4d5fc122a6b8d9d7df056b5f93f98d0bce68ca89966d614570982fde0e8b00d059dbbaf1b57ce7e2b9b5bf497582e10431cad0e88efc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f3de7d33c316424a0b8f88ee6abce630

SHA1
c64c20b42d70eb56b204f9e64b28f068b89a619a

SHA256
cb0a220b33344c9802917c3eb4bfd95a9afc5070aad34468ce9c37ec2eb9115a

SHA512
0ef5bbf56144e61f1061fd3944408eb4fb8e0a94dc96866d0c9d1caff0b11c13417213b03db4eeb2c65457f16f9e340b0fb5ccbe219d1fa0d0466d94651e7179

Download Submit
C:\Users\Admin\AppData\Local\Temp\igkoi.exe

Filesize
326KB

MD5
6ca44a595b2ffb8a759c897021cf114e

SHA1
50d7364d269abd96f314f2e7737e27c892dbf832

SHA256
d3c32009a7dce41d26d81a0f4bf41247732c98ce89260d15f0154185f03fd6ec

SHA512
a842a752f93fd5a3e37058d4833b50208197fde0fb7f09c70d7bee9be2c3270f0cc143dfec6d6942f7b8aae57a4cb55f721ca15a849bff1286126f25867c42e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylcef.exe

Filesize
172KB

MD5
58273f0e3656d7d1946ba095c353fdf7

SHA1
a72e6a0d27eaf3a2d8fec91593277f325bdc34bc

SHA256
b961516f672ea61b32c70095c3395d9a17abc6a4340cc8273b483850977e106f

SHA512
89cb114450cd2ddd84dec66418585ea25745b3650a373c8e90d9f20d438fc0774ea6f6b86a69afd17e82408328b47f89f1d359d4d0b642f68a43a4ecd82f4c00

Download Submit
memory/3720-47-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/3720-46-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-51-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-50-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-49-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-38-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-39-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/3720-48-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3720-42-0x0000000000E30000-0x0000000000EC9000-memory.dmp

Filesize
612KB

Download
memory/3784-17-0x0000000000AF0000-0x0000000000B71000-memory.dmp

Filesize
516KB

Download
memory/3784-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3784-0-0x0000000000AF0000-0x0000000000B71000-memory.dmp

Filesize
516KB

Download
memory/4268-21-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/4268-41-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Filesize
516KB

Download
memory/4268-20-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Filesize
516KB

Download
memory/4268-14-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/4268-11-0x0000000000CF0000-0x0000000000D71000-memory.dmp

Filesize
516KB

Download