urelas | 79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510

General

Target

79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe
Size

332KB
MD5

b09020dd8f734eadf440b69c73712ba0
SHA1

a1fd6546be419b349d10be0f7dd6a4d2e529854e
SHA256

79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510
SHA512

67375bec2c5b3bfa940398381bbb64a5575694998b7e67ff15d975fbcbbfb0a86f75b6231ac7e979ccf6e200fa56975d5a6e719b80f6f4f5d96fddee67e2fee2
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVo:vHW138/iXWlK885rKlGSekcj66ciEo

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exeboovb.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	boovb.exe

Executes dropped EXE 2 IoCs

Processes:

boovb.exesulyg.exe

pid	Process
2828	boovb.exe
3788	sulyg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exeboovb.execmd.exesulyg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boovb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sulyg.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

sulyg.exe

pid	Process
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe
3788	sulyg.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exeboovb.exe

description	pid	Process	procid_target
PID 1572 wrote to memory of 2828	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	87
PID 1572 wrote to memory of 2828	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	87
PID 1572 wrote to memory of 2828	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	87
PID 1572 wrote to memory of 4276	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	88
PID 1572 wrote to memory of 4276	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	88
PID 1572 wrote to memory of 4276	1572	79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe	88
PID 2828 wrote to memory of 3788	2828	boovb.exe	101
PID 2828 wrote to memory of 3788	2828	boovb.exe	101
PID 2828 wrote to memory of 3788	2828	boovb.exe	101

C:\Users\Admin\AppData\Local\Temp\79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe
"C:\Users\Admin\AppData\Local\Temp\79a9298000ac5816da0161413a84bce2517f181ae9fe9e73141b1f8e4d0cc510N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\boovb.exe
  "C:\Users\Admin\AppData\Local\Temp\boovb.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\sulyg.exe
    "C:\Users\Admin\AppData\Local\Temp\sulyg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
0f62c5db33e6a09b1be91f5cf0c7629d

SHA1
20ee8300881fe8c0359d0258539d81c53d5a2a1b

SHA256
45a902081eabbc7ed2c13e32dd1d77323cffd36ada27d5dd5541822db42e4de0

SHA512
9f41b912cc3b27f374a884a43a49f3a2e14ad3e96b66490c2ace99bfa3e31b64af34ba40709946f4fd3c9f796a62086f78ee60f0823ea7c951f7b2ec25f46b8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\boovb.exe

Filesize
332KB

MD5
914889a6b674768be95f27758a90331e

SHA1
815298631ff2964209597e19777212bda19af7ef

SHA256
669da01bb91f113ec48d69e37529de7738c4959c9a6c99e7601248e08a310bc0

SHA512
7ef714d55c5b92815f2afb993056e0d50103be059a79fe1d4bfe94e5308511fd83b3d5f9f7a4cdfead19cb3f93749153fb1c0446005d53aae860808afd6c029f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
9c584c3639873e12067e348022002e5a

SHA1
da2253297f2559235654097807737abaf13b0958

SHA256
5c3b92c3d65e0a6324e05d80defb797c1fb7e5e666bfeabe706038f8becaf0a5

SHA512
39b70ebbddfdd6d0d4acfeeb0c1d9d213d77d77dd8b406c6b8403f3e1b4dbe2fdaef2bdaeeb3f4d876c7e127ac26de690b57639bed040887262550909586833b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sulyg.exe

Filesize
172KB

MD5
fa23400d29a9fc63b3cfae8e63d063b6

SHA1
731da8cbd982b4adb95c7707e4ce6184993ccaf1

SHA256
cda87af6cf4c12d81db72718fb89e5db02ea6ca44e6b2d456438f376576eee4a

SHA512
0516ec024c8d546dddd60548ac4cbd7417d3442dca936bf63db6983b9a91ab48b24379cf30d52dbe42c062c01df43840a50911e0eb054369a522a078c70e327f

Download Submit
memory/1572-1-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1572-0-0x0000000000600000-0x0000000000681000-memory.dmp

Filesize
516KB

Download
memory/1572-17-0x0000000000600000-0x0000000000681000-memory.dmp

Filesize
516KB

Download
memory/2828-20-0x0000000000520000-0x00000000005A1000-memory.dmp

Filesize
516KB

Download
memory/2828-14-0x0000000000520000-0x00000000005A1000-memory.dmp

Filesize
516KB

Download
memory/2828-15-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2828-39-0x0000000000520000-0x00000000005A1000-memory.dmp

Filesize
516KB

Download
memory/3788-37-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Filesize
612KB

Download
memory/3788-40-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

Filesize
8KB

Download
memory/3788-41-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Filesize
612KB

Download
memory/3788-46-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

Filesize
8KB

Download
memory/3788-45-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Filesize
612KB

Download
memory/3788-47-0x0000000000BF0000-0x0000000000C89000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads