urelas | 8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
Size

332KB
MD5

80c40844ce7c96763356bc8f55442a60
SHA1

f2b0bc7ff2c7803dee7c975f8ddc67f80ed59eba
SHA256

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472
SHA512

490bb52421406db27c3b12add8876edefbece2aacb87fac488fcb9535aba787025f18776be54d3b26d36e79ef40c8bfa25b5e3b351241cac850c550d9eb600b2
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYh:vHW138/iXWlK885rKlGSekcj66cik

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2332	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

ugutk.exewizox.exe

pid	Process
2284	ugutk.exe
2196	wizox.exe

Loads dropped DLL 2 IoCs

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exeugutk.exe

pid	Process
2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
2284	ugutk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exeugutk.execmd.exewizox.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ugutk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wizox.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

wizox.exe

pid	Process
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe
2196	wizox.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exeugutk.exe

description	pid	Process	procid_target
PID 2396 wrote to memory of 2284	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	30
PID 2396 wrote to memory of 2284	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	30
PID 2396 wrote to memory of 2284	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	30
PID 2396 wrote to memory of 2284	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	30
PID 2396 wrote to memory of 2332	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	31
PID 2396 wrote to memory of 2332	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	31
PID 2396 wrote to memory of 2332	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	31
PID 2396 wrote to memory of 2332	2396	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	31
PID 2284 wrote to memory of 2196	2284	ugutk.exe	34
PID 2284 wrote to memory of 2196	2284	ugutk.exe	34
PID 2284 wrote to memory of 2196	2284	ugutk.exe	34
PID 2284 wrote to memory of 2196	2284	ugutk.exe	34

C:\Users\Admin\AppData\Local\Temp\8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
"C:\Users\Admin\AppData\Local\Temp\8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\ugutk.exe
  "C:\Users\Admin\AppData\Local\Temp\ugutk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\wizox.exe
    "C:\Users\Admin\AppData\Local\Temp\wizox.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
71eb4b9da5a2bedfb95309abd47afa79

SHA1
26d120c4c4a958c747ce7da21d20e7d04f1d0427

SHA256
235fd21006190231308a396c57ddf9c2e7484667665d628a83ebe1a57d0446e3

SHA512
1988d422c392d43b674ca64c76c1e541d16bf6634c036cc7709884169f07c4969ad043e4028a83bb412c983e423570108ca6307c5311d55f57dc23827c12cc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
314058f16aa9662135d630725a41014a

SHA1
6c0dce46798d76e6072c6d77b85cf8548fa1c930

SHA256
2c060c163f7b96335561778fabe7bb993f85a180129ce41eef111ad79d60161f

SHA512
8ab132764b4d13721e5f95634e4c99c906c2647591cf4404c7be0a51358b2ac6e64cda22250c499c8691c37155ff181d677786b4325d2a9b53405f05b0bb4934

Download Submit
C:\Users\Admin\AppData\Local\Temp\ugutk.exe

Filesize
332KB

MD5
dc747d19b4def64e78daab0bfa53d576

SHA1
4f5ab7c63180c134f1c394eb82a630f73ea05e9f

SHA256
974ddd2fc42d4650b27a76af91e60e8c07c7841e27daa711dc13a5d71fa63e97

SHA512
39ae444a94119b7e6378755b9e2b5a4bdafe0cb3c04e0d7692af11b256b3e3c89398f2bc6d4720454095985a8bd0aae86b70996a410e6eb7a4615f2997f45065

Download Submit
C:\Users\Admin\AppData\Local\Temp\wizox.exe

Filesize
172KB

MD5
8ebf392a98bd83e06af147b8a877a603

SHA1
da4cd27834b305a3ca465ec365b7a5d6674dbe67

SHA256
e1df67ff34377c62f9674ffbe43ea5067e541bdba6473c434acfe4f04b6d634e

SHA512
1a76e654c4876934c556783f98f9ae70ebaa602f2e17f1a05f365a25346fc8aa06d73bdcf175ff9ff78e7c6734cfdc8e6c8d1fc8516fbb587041522ec0fdb7fb

Download Submit
memory/2196-43-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-52-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-51-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-50-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-49-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-48-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2196-44-0x0000000000D70000-0x0000000000E09000-memory.dmp

Filesize
612KB

Download
memory/2284-19-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2284-42-0x0000000001010000-0x0000000001091000-memory.dmp

Filesize
516KB

Download
memory/2284-25-0x0000000001010000-0x0000000001091000-memory.dmp

Filesize
516KB

Download
memory/2284-39-0x0000000000D00000-0x0000000000D99000-memory.dmp

Filesize
612KB

Download
memory/2284-24-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2284-18-0x0000000001010000-0x0000000001091000-memory.dmp

Filesize
516KB

Download
memory/2396-17-0x0000000001FD0000-0x0000000002051000-memory.dmp

Filesize
516KB

Download
memory/2396-0-0x00000000008C0000-0x0000000000941000-memory.dmp

Filesize
516KB

Download
memory/2396-21-0x00000000008C0000-0x0000000000941000-memory.dmp

Filesize
516KB

Download
memory/2396-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download