urelas | 8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
Size

332KB
MD5

80c40844ce7c96763356bc8f55442a60
SHA1

f2b0bc7ff2c7803dee7c975f8ddc67f80ed59eba
SHA256

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472
SHA512

490bb52421406db27c3b12add8876edefbece2aacb87fac488fcb9535aba787025f18776be54d3b26d36e79ef40c8bfa25b5e3b351241cac850c550d9eb600b2
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYh:vHW138/iXWlK885rKlGSekcj66cik

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exejovod.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	jovod.exe

Executes dropped EXE 2 IoCs

Processes:

jovod.exebiqee.exe

pid	Process
4880	jovod.exe
2940	biqee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exejovod.execmd.exebiqee.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jovod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biqee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

biqee.exe

pid	Process
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe
2940	biqee.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exejovod.exe

description	pid	Process	procid_target
PID 2000 wrote to memory of 4880	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	88
PID 2000 wrote to memory of 4880	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	88
PID 2000 wrote to memory of 4880	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	88
PID 2000 wrote to memory of 1624	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	89
PID 2000 wrote to memory of 1624	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	89
PID 2000 wrote to memory of 1624	2000	8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe	89
PID 4880 wrote to memory of 2940	4880	jovod.exe	109
PID 4880 wrote to memory of 2940	4880	jovod.exe	109
PID 4880 wrote to memory of 2940	4880	jovod.exe	109

C:\Users\Admin\AppData\Local\Temp\8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe
"C:\Users\Admin\AppData\Local\Temp\8e42be2989a9b30e16a67eb16e4dc34bd3032e4f5d65c3762b05c7d70fab3472N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\jovod.exe
  "C:\Users\Admin\AppData\Local\Temp\jovod.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\biqee.exe
    "C:\Users\Admin\AppData\Local\Temp\biqee.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
71eb4b9da5a2bedfb95309abd47afa79

SHA1
26d120c4c4a958c747ce7da21d20e7d04f1d0427

SHA256
235fd21006190231308a396c57ddf9c2e7484667665d628a83ebe1a57d0446e3

SHA512
1988d422c392d43b674ca64c76c1e541d16bf6634c036cc7709884169f07c4969ad043e4028a83bb412c983e423570108ca6307c5311d55f57dc23827c12cc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\biqee.exe

Filesize
172KB

MD5
0d5a2a53f78ae7584a281935ca7dd1ce

SHA1
3067b330e2638ae4946bef608b1d444cc20e4c0e

SHA256
fca6f371517014f4b7365feecf9325fb43138f3e0896832f20279e3b568c69fb

SHA512
9427c3fefd944a99bae0b962fb70bbda67c6393afa2f617d6c8c118e24046dab61626abdf5dc20013bb7b05f5277272b4654cc83f2d83e57ca990b1094d08d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6df0a60205c1e5b8a6cb77e158260678

SHA1
af227026832d4e8b3bad015c98a0b8e95e15fff5

SHA256
fa8037a5f273232d78043eae0cb9d38cff1ec3d443ee088f3e9e50e6cc52bf6a

SHA512
87590fccd0cadc6b11e6184e6a739e71e83107cd3be460c979eb904d597646a7bfaea0b825cc10575434fa8ba59b2273392744171846f806b7d585b34e9ab293

Download Submit
C:\Users\Admin\AppData\Local\Temp\jovod.exe

Filesize
332KB

MD5
be4f41391a0aa7c3103e17b4ec64310b

SHA1
e051d7ca3a0128f2e5479c9cc5f802c291225df9

SHA256
47395c695ea4e82c136c15afb89adcc5b1936119bbceebccf320e6fc0a5fd179

SHA512
221dcc3c6e5223af631720ee5418106bd7f0b5274da757a2b2babf95d079319c24c79533670e80e02dfb5a8e764ef9cf1a2d9c2db4bc629511ef020ecd80e890

Download Submit
memory/2000-17-0x0000000000DD0000-0x0000000000E51000-memory.dmp

Filesize
516KB

Download
memory/2000-0-0x0000000000DD0000-0x0000000000E51000-memory.dmp

Filesize
516KB

Download
memory/2000-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2940-47-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-51-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-50-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-49-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-39-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/2940-40-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-48-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-38-0x0000000000CB0000-0x0000000000D49000-memory.dmp

Filesize
612KB

Download
memory/2940-46-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/4880-21-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/4880-44-0x0000000000870000-0x00000000008F1000-memory.dmp

Filesize
516KB

Download
memory/4880-20-0x0000000000870000-0x00000000008F1000-memory.dmp

Filesize
516KB

Download
memory/4880-14-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/4880-11-0x0000000000870000-0x00000000008F1000-memory.dmp

Filesize
516KB

Download