urelas | 41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72

General

Target

41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe
Size

326KB
MD5

50a3d5650fd5b53e793e526147985840
SHA1

8e7bc7907a5f24c7bd3331ee3d7ac8b32617b042
SHA256

41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72
SHA512

79b3208a137098624c847a42cf8fc3370428cafb350b91532ac592b239ebaac55811ff60a2fba5e022097510429b6b2505b7b063786e4dff8650841123636548
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY5:vHW138/iXWlK885rKlGSekcj66ci0

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exeakfaa.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	akfaa.exe

Executes dropped EXE 2 IoCs

Processes:

akfaa.exegyitn.exe

pid	Process
1992	akfaa.exe
1704	gyitn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

gyitn.exe41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exeakfaa.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gyitn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akfaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

gyitn.exe

pid	Process
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe
1704	gyitn.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exeakfaa.exe

description	pid	Process	procid_target
PID 3084 wrote to memory of 1992	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	89
PID 3084 wrote to memory of 1992	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	89
PID 3084 wrote to memory of 1992	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	89
PID 3084 wrote to memory of 2196	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	90
PID 3084 wrote to memory of 2196	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	90
PID 3084 wrote to memory of 2196	3084	41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe	90
PID 1992 wrote to memory of 1704	1992	akfaa.exe	108
PID 1992 wrote to memory of 1704	1992	akfaa.exe	108
PID 1992 wrote to memory of 1704	1992	akfaa.exe	108

C:\Users\Admin\AppData\Local\Temp\41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe
"C:\Users\Admin\AppData\Local\Temp\41c30ab8d57535ff7528e65ede130a88d3bf5a5cf75586d3ec33ea38f084cf72N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\akfaa.exe
  "C:\Users\Admin\AppData\Local\Temp\akfaa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\gyitn.exe
    "C:\Users\Admin\AppData\Local\Temp\gyitn.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
b65c0e5c9635e3d150f505115b7a84c1

SHA1
348b499ff301db54c4b54cf32ba8af5a8274532b

SHA256
139f15f77361de23c657a4d6be0499b23fdafb0277b255f357080f2c891e0f05

SHA512
3fbed4aa47e2ba8102e0bfa172cfe306997d1f6f443e73292725c68677546f05fd8d6efeba0409606a00eea4c2c70cd5ad112530f657288c208fd5ae038bfd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\akfaa.exe

Filesize
326KB

MD5
2fd40c46a106b645dfb8dd71b4973431

SHA1
3a0186cdb76278a9360fb5a9917639ddffa670a0

SHA256
1743dd9e6a53b295136043c96e55b29548fd80bb94c394e5f793d94383d84fe3

SHA512
c73dc4ed5af84850500ce8784408b48f1083ff6fc195e55353cf087a15b049a4b5fea945a8ad45a379eeb0fa6d20764fdd694c0c18dfc2a3c458c72a9d871f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
8368378e2d8384bc4cdcbb16ecd8f5c5

SHA1
6c8e2ca1c9193de50796eb9da07be537d6a76b52

SHA256
349c0a83c9d36467f3ccaf8ed6f7357bfcb0fb711f48a40aaecdbf303db16adf

SHA512
5d656b8e3bf970bb981802d24e3207e9a23fdee4c114d0e6488358dce10f414765ac7fe1e1cd084c0d8500dc46b1fc34e58dba087cb740434a8f92b40ea90ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyitn.exe

Filesize
172KB

MD5
0f52d8d7f95adae470dd9421c52925e6

SHA1
ed9026594af8032b68e1658853d1e1f0699e09c5

SHA256
e000ac5c1b55190804c9a8169cea16de5860336c1a57f455f542bb476997da82

SHA512
8ce7f839df66f64e5aae6117b453b3dd269226540117b4efec891bcae974ee48798ac836b124246601436ed6b38755e547b0878aa177fb066e3e51278730efbb

Download Submit
memory/1704-38-0x0000000000CF0000-0x0000000000D89000-memory.dmp

Filesize
612KB

Download
memory/1704-48-0x0000000000C60000-0x0000000000C62000-memory.dmp

Filesize
8KB

Download
memory/1704-47-0x0000000000CF0000-0x0000000000D89000-memory.dmp

Filesize
612KB

Download
memory/1704-43-0x0000000000CF0000-0x0000000000D89000-memory.dmp

Filesize
612KB

Download
memory/1704-42-0x0000000000C60000-0x0000000000C62000-memory.dmp

Filesize
8KB

Download
memory/1992-40-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/1992-12-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/1992-16-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1992-22-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/3084-11-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3084-0-0x0000000000D40000-0x0000000000DC1000-memory.dmp

Filesize
516KB

Download
memory/3084-1-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3084-8-0x0000000000D40000-0x0000000000DC1000-memory.dmp

Filesize
516KB

Download
memory/3084-19-0x0000000000D40000-0x0000000000DC1000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads