urelas | 31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/10/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe
Size

330KB
MD5

574b21767e108012461c55b68fa4859a
SHA1

87bc2c0d8a0bc4a557eab7c655af9a25cdd3f509
SHA256

31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae
SHA512

0d56f0ec36795efdff4dbaf7bddbfc3770a130f9c96f25738d5be140b7bb25020d3b9eb62d3e2f4355bc5447fbbfda50ed6f53497892bccba75408cd04947fee
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYV7:vHW138/iXWlK885rKlGSekcj66ciE7

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2880	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1504	ibjyg.exe
3000	wibyt.exe

Loads dropped DLL 2 IoCs

pid	Process
2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe
1504	ibjyg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wibyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibjyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe
3000	wibyt.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1504	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	30
PID 2128 wrote to memory of 1504	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	30
PID 2128 wrote to memory of 1504	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	30
PID 2128 wrote to memory of 1504	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	30
PID 2128 wrote to memory of 2880	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	31
PID 2128 wrote to memory of 2880	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	31
PID 2128 wrote to memory of 2880	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	31
PID 2128 wrote to memory of 2880	2128	31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe	31
PID 1504 wrote to memory of 3000	1504	ibjyg.exe	33
PID 1504 wrote to memory of 3000	1504	ibjyg.exe	33
PID 1504 wrote to memory of 3000	1504	ibjyg.exe	33
PID 1504 wrote to memory of 3000	1504	ibjyg.exe	33

C:\Users\Admin\AppData\Local\Temp\31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe
"C:\Users\Admin\AppData\Local\Temp\31a7a6a76277be46d2cf9fca4d7bc90fefeb41eadab5486d1599a3044df631ae.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\ibjyg.exe
  "C:\Users\Admin\AppData\Local\Temp\ibjyg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\wibyt.exe
    "C:\Users\Admin\AppData\Local\Temp\wibyt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
6790c30365b383b27826bed40956de20

SHA1
ab049a238e52322795aeab9c00328f2d69be60f9

SHA256
b8f9042e725b4b36536392412402f49ca2a8e496e2663cd86e29e1b7f989c446

SHA512
94f7ddc9b4c77ce0dd2e2e40c0e6fda5a9598cfc1fb2630d016b4cb3b879eec80a5a8832843fce53b0ff0282fdafa734d1675e3de49b7b6bd9fd590a06bf3646

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
fb3f33f5858809a4343ef2423822b215

SHA1
c3ad705e1abd179d33987b12b2b17658daffb974

SHA256
e58665a61ea7434493f08e341d5e04ecd54e4b700f84100968bd6d6470f6b2a1

SHA512
df25caa51d247776b9b578510c5a9ae1ff82e90c3c7f5e70e58e5808d4432c20f7c0fa82186cdd39b8a298ee23e3758d982ac7e62f71691c3458a80952c22502

Download Submit
C:\Users\Admin\AppData\Local\Temp\ibjyg.exe

Filesize
330KB

MD5
3b4db8ba0d6566c159cf889bad9169bf

SHA1
854a965b004847aea8e66dd2d6a622b3a62648f2

SHA256
16794ac2c6a96fba4d0f3522f3d89afba6c69e0968a7e5a42f84ccb5d3a35084

SHA512
dec636b94ead30d5e8bb06341d5314b4b37606ab0bf0129ac6967421e4d13f6e9e3ef9895187c2d66bf5957639ae8453f84707051e3dda537852bf90952f27de

Download Submit
\Users\Admin\AppData\Local\Temp\wibyt.exe

Filesize
172KB

MD5
9f2f54aad59777d2a5bfe669d99e0e57

SHA1
9fac4deaf081d49e28d89edc4855e78511fbb4b5

SHA256
a77b336471455b19c36694ac4e603767437e728a47aa08a6aa0d8d59eaa66241

SHA512
8d3441c5f0a8e2041d6001e133823dd6c60fb28b164a007f2cd5765593720ba978ca4f6d8302ded45a4d0191e5c01b858fc8f4f19be71b0ab278a8e4f72c9d9a

Download Submit
memory/1504-42-0x0000000000940000-0x00000000009C1000-memory.dmp

Filesize
516KB

Download
memory/1504-11-0x0000000000940000-0x00000000009C1000-memory.dmp

Filesize
516KB

Download
memory/1504-24-0x0000000000940000-0x00000000009C1000-memory.dmp

Filesize
516KB

Download
memory/1504-25-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1504-38-0x00000000039F0000-0x0000000003A89000-memory.dmp

Filesize
612KB

Download
memory/1504-12-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2128-21-0x0000000001250000-0x00000000012D1000-memory.dmp

Filesize
516KB

Download
memory/2128-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2128-0-0x0000000001250000-0x00000000012D1000-memory.dmp

Filesize
516KB

Download
memory/2128-9-0x0000000000FB0000-0x0000000001031000-memory.dmp

Filesize
516KB

Download
memory/3000-44-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-43-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-48-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-49-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-50-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-51-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download
memory/3000-52-0x00000000003A0000-0x0000000000439000-memory.dmp

Filesize
612KB

Download