urelas | f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe
Size

332KB
MD5

83374076dc6ef5d043bea1f7c10d9cf4
SHA1

b62c29e9220f2ab6332ba3f284241b040d5f11bb
SHA256

f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f
SHA512

20581f3f8a28f35259b1b2b486668cc2a4b3ac7a9c2ebe8d676dbecbf9f75cee13500fb114cdfb4d53f901b0642e3de021412ec01d22bc6e1d1798fc3d8cef7d
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVU:vHW138/iXWlK885rKlGSekcj66ciEU

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exezupie.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	zupie.exe

Executes dropped EXE 2 IoCs

Processes:

zupie.execerop.exe

pid	Process
2148	zupie.exe
1052	cerop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cerop.exef3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exezupie.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cerop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zupie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cerop.exe

pid	Process
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe
1052	cerop.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exezupie.exe

description	pid	Process	procid_target
PID 3632 wrote to memory of 2148	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	88
PID 3632 wrote to memory of 2148	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	88
PID 3632 wrote to memory of 2148	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	88
PID 3632 wrote to memory of 1768	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	89
PID 3632 wrote to memory of 1768	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	89
PID 3632 wrote to memory of 1768	3632	f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe	89
PID 2148 wrote to memory of 1052	2148	zupie.exe	110
PID 2148 wrote to memory of 1052	2148	zupie.exe	110
PID 2148 wrote to memory of 1052	2148	zupie.exe	110

C:\Users\Admin\AppData\Local\Temp\f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe
"C:\Users\Admin\AppData\Local\Temp\f3af36c62543da904680017ab487af4301dcf4bc8434bc1870dadb35b65b106f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\zupie.exe
  "C:\Users\Admin\AppData\Local\Temp\zupie.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\cerop.exe
    "C:\Users\Admin\AppData\Local\Temp\cerop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
56c8c7ce1a30447dd8273707cccc2238

SHA1
c6303e6f618cb8e809e0535627555b493e92c04f

SHA256
c2f4d3aef0a6152f7c2b5a335e53056a45800c6ea1dc5d33c8059d98ebfaf28c

SHA512
7065b88d808f760c521f5db7eb237bebe05a85c1e69f4000de3e89381021e8bcb8f9c8b540f8477d20e4addc5d2ec48d6ff170a597f8fc6b6994e27500cbf93e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cerop.exe

Filesize
172KB

MD5
80efd46e93049ea7417a41d6d5abdfa6

SHA1
faf4d8fa78c38c5022a8f977bc4d619b824a02af

SHA256
fad95f366e86638a8150a98c0df946ea0099c32fe9ab61d861f777c804d308f9

SHA512
51cbdbd9362e05ac48a9de00f5281f65d85c6eb6137de2ce37025003b37ac6eeb64a5a5c066190c34ec9ed116b6b5703515f3d4276a1fa769e941f06716eb1a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3e23ef28b3eb0a606316e674b60b6bc4

SHA1
7de148fc128f80894b7c8605a5ff253fb15ae91f

SHA256
4da10dac931f2b9b7a901385456720ae70fc172e3c327c237c7e86513672ce49

SHA512
908cb0bba63521a154d917a785ef32a3d134a0a81791e31bddea1936cbd2fe53e272f26fa558628969f5fcd0495e050e0f73d8895bc762d69272afa0a664b3fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zupie.exe

Filesize
332KB

MD5
9a7170ee1cef699695a007a52436da2c

SHA1
feec621d2d8d5c97659d1a652d345bccbe700384

SHA256
9452512b621a707c4ae7f2afcd500f3d4b573fa96d7d66aba2a6ed8f23b4d1da

SHA512
4b68789582691b8d6cd419706df05b4b7d61c22a80d78913e8d20cf940e99aa49304d378d1f520390d04edda60775bedf8d4d985661a06da0005e815ab7292ab

Download Submit
memory/1052-46-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/1052-47-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-50-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-49-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-48-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-45-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-41-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/1052-40-0x00000000009F0000-0x00000000009F2000-memory.dmp

Filesize
8KB

Download
memory/1052-37-0x0000000000ED0000-0x0000000000F69000-memory.dmp

Filesize
612KB

Download
memory/2148-39-0x00000000004A0000-0x0000000000521000-memory.dmp

Filesize
516KB

Download
memory/2148-20-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/2148-19-0x00000000004A0000-0x0000000000521000-memory.dmp

Filesize
516KB

Download
memory/2148-11-0x00000000004A0000-0x0000000000521000-memory.dmp

Filesize
516KB

Download
memory/2148-15-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/3632-1-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3632-0-0x0000000000DF0000-0x0000000000E71000-memory.dmp

Filesize
516KB

Download
memory/3632-16-0x0000000000DF0000-0x0000000000E71000-memory.dmp

Filesize
516KB

Download