urelas | f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe
Size

330KB
MD5

f1e1cde1b78c3011c4d37b778f8f28e0
SHA1

1fe7cf690f5b87e656dc61d2e0855347bf511063
SHA256

f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81a
SHA512

31bca1575ae095daf1fcd97dc007c839224addbc90c72435dec7557edbfa98027c2785d7fda7874fe7635c670775a2b0f8eadaed30f4ba66d9044476aba71e9a
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYw:vHW138/iXWlK885rKlGSekcj66ci1

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

qyylm.exef8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	qyylm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe

Executes dropped EXE 2 IoCs

Processes:

qyylm.exeidhiu.exe

pid	Process
3664	qyylm.exe
4060	idhiu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

idhiu.exef8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exeqyylm.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idhiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qyylm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

idhiu.exe

pid	Process
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe
4060	idhiu.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exeqyylm.exe

description	pid	Process	procid_target
PID 4660 wrote to memory of 3664	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	88
PID 4660 wrote to memory of 3664	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	88
PID 4660 wrote to memory of 3664	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	88
PID 4660 wrote to memory of 896	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	89
PID 4660 wrote to memory of 896	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	89
PID 4660 wrote to memory of 896	4660	f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe	89
PID 3664 wrote to memory of 4060	3664	qyylm.exe	102
PID 3664 wrote to memory of 4060	3664	qyylm.exe	102
PID 3664 wrote to memory of 4060	3664	qyylm.exe	102

C:\Users\Admin\AppData\Local\Temp\f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe
"C:\Users\Admin\AppData\Local\Temp\f8beae60feb8cb699b63cebd50da965c12ea3bc1f1477adf3c930cba1364f81aN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\qyylm.exe
  "C:\Users\Admin\AppData\Local\Temp\qyylm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\idhiu.exe
    "C:\Users\Admin\AppData\Local\Temp\idhiu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
3a85ad7e26b9ba614e2c31d19781c991

SHA1
3145733944a8aa72b818f8878b734efa4f3b1a3b

SHA256
785cbb203160b3f082d3b9f1d74a4463dd759228247c63b98f466aab26c7ce16

SHA512
39e6f1b31d76356cd04938b7c27bbb487aecad37a51dc05b047d4245ee479bf0bcacb5cd74152e2d30bfc97019f8de7a5084e8b210d6e620c55f5afdf2046ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
8bd7b1179e19182a4e2173a7b7ee43de

SHA1
4891b1b8ee662a7c80e362cd14bca4c0efba25ef

SHA256
a44e6f51a0fb460d0b6bcd751481f798b7e58b04db01357f6e9e12a79ffa89ec

SHA512
0175a76aa760fd57bd16a3aa1ec76af3fcca547decc4c6f84fae1aa75615f6abc680609c8730b2d31881cd52da9ec7be1d2150a93f0172c84bf2661c89aa98aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\idhiu.exe

Filesize
172KB

MD5
28b69c9f21107bb9c5dcab2829df1252

SHA1
94fb0ea19e145efbf5b40ad4f677dc4d37ce4edb

SHA256
ce0a3fa128fa05f0f5bda2127534affbb5205c32582fc9f3c32a3e4de107c4b7

SHA512
b5970c6499ff5d329f618736897fff4f0ef0a66797a0014dd2ed973816813fb7bcb6eda352325a829d373da22eb6d7aa8372f32536dc4263eca5002d82863127

Download Submit
C:\Users\Admin\AppData\Local\Temp\qyylm.exe

Filesize
330KB

MD5
adc97e00e18fff90e1cd0a3798cc2055

SHA1
77ad66eca09e4149c2ff0cf8077c26d1681eeec5

SHA256
85efde7f5277e5af6f3d67cb08c1e19cf10ca33fc7b73b6e49456781ae50ba89

SHA512
40b7f3b1e614b3d61668a06cac9f49beddf148fef1cc9999d37500aa36b3871a3679b9f9027d6c45dd91312febca1ca7c36d26319350a4fa12d4b7d8522cf806

Download Submit
memory/3664-13-0x0000000000200000-0x0000000000281000-memory.dmp

Filesize
516KB

Download
memory/3664-43-0x0000000000200000-0x0000000000281000-memory.dmp

Filesize
516KB

Download
memory/3664-21-0x0000000000200000-0x0000000000281000-memory.dmp

Filesize
516KB

Download
memory/3664-14-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/3664-20-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4060-44-0x0000000000970000-0x0000000000972000-memory.dmp

Filesize
8KB

Download
memory/4060-39-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-38-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-46-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-47-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-48-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-49-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4060-50-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/4660-17-0x0000000000960000-0x00000000009E1000-memory.dmp

Filesize
516KB

Download
memory/4660-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/4660-0-0x0000000000960000-0x00000000009E1000-memory.dmp

Filesize
516KB

Download