urelas | 3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fc

General

Target

3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe
Size

324KB
MD5

96cbd49ff3683846471981dcab152fc0
SHA1

8bf48d25256ae54a9d1afc01aaa7d99a80a3297f
SHA256

3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fc
SHA512

eef98866db824f707f05d038a6a9381037e9cba538fa3954306377a26e61c80438b62a29205c30f4c42e4c52637f3f70b5dadedbe717a184e0ece843b1e28230
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYX:vHW138/iXWlK885rKlGSekcj66cim

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exedisif.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	disif.exe

Executes dropped EXE 2 IoCs

Processes:

disif.exewywej.exe

pid	Process
3220	disif.exe
1732	wywej.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exedisif.execmd.exewywej.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	disif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wywej.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

wywej.exe

pid	Process
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe
1732	wywej.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exedisif.exe

description	pid	Process	procid_target
PID 1920 wrote to memory of 3220	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	87
PID 1920 wrote to memory of 3220	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	87
PID 1920 wrote to memory of 3220	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	87
PID 1920 wrote to memory of 3008	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	88
PID 1920 wrote to memory of 3008	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	88
PID 1920 wrote to memory of 3008	1920	3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe	88
PID 3220 wrote to memory of 1732	3220	disif.exe	106
PID 3220 wrote to memory of 1732	3220	disif.exe	106
PID 3220 wrote to memory of 1732	3220	disif.exe	106

C:\Users\Admin\AppData\Local\Temp\3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe
"C:\Users\Admin\AppData\Local\Temp\3683a5e661ebd9bc007fe9fa34179f944af75796dbd23fd2421400cd643dd2fcN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\disif.exe
  "C:\Users\Admin\AppData\Local\Temp\disif.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\AppData\Local\Temp\wywej.exe
    "C:\Users\Admin\AppData\Local\Temp\wywej.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
bc08f8ac91d6612094694b5f3a19c5f5

SHA1
62273a0c7275a4191890a7d034a6b176ba17f63c

SHA256
6d9c1b28c359197345b80edb5bcc7fb24f4c2658d345428d0dbd2870cde89343

SHA512
4ce12e5bfc2e5a3f0e100149f6ba9245d0c7bc452fa847ce6064288a9221de9279a21bcd25fe355cbf9c5fd39a18710d74a9cdab86210bdeebb2966c8425965f

Download Submit
C:\Users\Admin\AppData\Local\Temp\disif.exe

Filesize
324KB

MD5
8c66f455075f63fa27f7543967b71ac9

SHA1
dd9974db89e48e66ae1ab59a5016b572645fb97c

SHA256
5bbd0d912da5c4caa3073bdd5f0bce15194c9cb454c1837822156744364f3d05

SHA512
9879b497f7e0ba54ea6582f40bfb3983c2645cf160c1083e370133c8e19c9bd0d008165b4446528b29a443a9aea4236bd89f3ec97ddba276599cc1116e067bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3091680c94258a542af3b11fa1eb1ff3

SHA1
7cbf0bab5c40251331630cef82921463a169d722

SHA256
8e8ab51f4fe5024583b3fdd8399f87bece2fa57d1d15290775a6ae69db0b9384

SHA512
a54dc7dc34ab1d852d5d7543576862248528d5729676e66716586a9574f543126d7676449f2b983aaed9bedd612e7baa7ff2270b75707a85fec2ef23b05b9fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\wywej.exe

Filesize
172KB

MD5
f06c875e35f5cf6bc69633831c9dbd5f

SHA1
c0ad81dcce5cca195caf91e48b39af6df65a9876

SHA256
923336908525ce7c9261dac5663d706950c392cd536595967b39dc633c69e383

SHA512
bac1123f6d43c1cac27d47df8b45a2f0ce73ea38237282384c9bd215c2954744b4a11b4a7ddcaa4f378041b85e8548c226ba367071933b25bf400cf1590797a5

Download Submit
memory/1732-44-0x00000000001C0000-0x0000000000259000-memory.dmp

Filesize
612KB

Download
memory/1732-46-0x00000000001C0000-0x0000000000259000-memory.dmp

Filesize
612KB

Download
memory/1732-38-0x00000000001C0000-0x0000000000259000-memory.dmp

Filesize
612KB

Download
memory/1732-37-0x0000000000BA0000-0x0000000000BA2000-memory.dmp

Filesize
8KB

Download
memory/1732-36-0x00000000001C0000-0x0000000000259000-memory.dmp

Filesize
612KB

Download
memory/1732-45-0x0000000000BA0000-0x0000000000BA2000-memory.dmp

Filesize
8KB

Download
memory/1920-16-0x00000000002C0000-0x0000000000341000-memory.dmp

Filesize
516KB

Download
memory/1920-1-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1920-0-0x00000000002C0000-0x0000000000341000-memory.dmp

Filesize
516KB

Download
memory/3220-19-0x0000000000590000-0x0000000000611000-memory.dmp

Filesize
516KB

Download
memory/3220-42-0x0000000000590000-0x0000000000611000-memory.dmp

Filesize
516KB

Download
memory/3220-15-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/3220-14-0x0000000000590000-0x0000000000611000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads