urelas | 378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995

General

Target

378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe
Size

324KB
MD5

597949f45a51a183b2cb794f4ebe2f60
SHA1

ca85370e47fbfa1424d4ab7e89e0286a68a41fa8
SHA256

378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995
SHA512

7240a58c3330b87d094727e4f87bd52929ac86f4444cbf54ee006003d8a3a0b1e82da754b08a9e43cabf030a03ffca14d7bbfe3979b6d14036fd65faf6c55345
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYH:vHW138/iXWlK885rKlGSekcj66cie

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exekycul.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	kycul.exe

Executes dropped EXE 2 IoCs

Processes:

kycul.exeidpub.exe

pid	Process
4804	kycul.exe
1124	idpub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

kycul.execmd.exeidpub.exe378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kycul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idpub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

idpub.exe

pid	Process
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe
1124	idpub.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exekycul.exe

description	pid	Process	procid_target
PID 1848 wrote to memory of 4804	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	87
PID 1848 wrote to memory of 4804	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	87
PID 1848 wrote to memory of 4804	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	87
PID 1848 wrote to memory of 3772	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	88
PID 1848 wrote to memory of 3772	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	88
PID 1848 wrote to memory of 3772	1848	378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe	88
PID 4804 wrote to memory of 1124	4804	kycul.exe	101
PID 4804 wrote to memory of 1124	4804	kycul.exe	101
PID 4804 wrote to memory of 1124	4804	kycul.exe	101

C:\Users\Admin\AppData\Local\Temp\378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe
"C:\Users\Admin\AppData\Local\Temp\378c0e918ece70f116fff3289db09765609ffc7579821c7e5d2860b59b26f995N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\kycul.exe
  "C:\Users\Admin\AppData\Local\Temp\kycul.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\idpub.exe
    "C:\Users\Admin\AppData\Local\Temp\idpub.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
f024ff3914b6b0332f680b1ce48381ee

SHA1
a9d8778af0e9432b9a60c42a4a2361821cbf9ae6

SHA256
f695fd7e7034d15c2d20c017d84498e7536e197251837cbb01b221f7303be1ea

SHA512
886649c57d62c9472016164f3cedc942efa81e2930beb14001e1a215a13070d105b3a0d73f2a6aface167142aa5a675008f42f684ebae0859bb912897949a0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
916fc4d532d7dd337f741256311388da

SHA1
901c1eb22fd6fdc668c822a3e1a0c02c29a9d094

SHA256
70f58a08b8f185d93a10c30367e187cc6782babc232ae68f8555a972a2cd7bc9

SHA512
4749007dd93e7149dcd6e2c8847a006d1729f6916b939ac14f918ccaf18ee2fd0d3eab2434cd1c59eaf0fddeac65af129149b8ce7c09ad19a7cd15e04ac3b3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\idpub.exe

Filesize
172KB

MD5
070333de261017ed9ef225ecec3c0db2

SHA1
4ccb7f308d285dde2f13f60ce540bc62392010a2

SHA256
d3f562069f8bcbb6775c936127d758661fa83da21bbeb06541ae2fcdb0197f6e

SHA512
3edcf321c9a937689600e8f7a0ff948726fed35b01325d6bcaf4f3c83533c28eaf0b6a9a369f03e79514a16989fb566259b77d8eae11da99959e38867227f829

Download Submit
C:\Users\Admin\AppData\Local\Temp\kycul.exe

Filesize
324KB

MD5
a2ab4d762d734164893c96fe54dd856b

SHA1
1fbaf3d230f8ebbbb30c5764b25061cc58667289

SHA256
1b1484dfcdddb844e52c4ac3b7cc7426c90615e0dc8780b41a0fb0ee9044ac22

SHA512
12dd23e3d86e464bf92e9a64090e66f1bdf380b6f98f6dc46d79dffc0c06ccaa4000b2fa7ebd7d9779f6ab4b95d71c8381720060adeff497c98c0d63af3f649c

Download Submit
memory/1124-46-0x0000000000940000-0x00000000009D9000-memory.dmp

Filesize
612KB

Download
memory/1124-44-0x0000000000940000-0x00000000009D9000-memory.dmp

Filesize
612KB

Download
memory/1124-40-0x0000000000940000-0x00000000009D9000-memory.dmp

Filesize
612KB

Download
memory/1124-36-0x0000000000940000-0x00000000009D9000-memory.dmp

Filesize
612KB

Download
memory/1124-37-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1124-45-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1848-16-0x0000000000750000-0x00000000007D1000-memory.dmp

Filesize
516KB

Download
memory/1848-1-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1848-0-0x0000000000750000-0x00000000007D1000-memory.dmp

Filesize
516KB

Download
memory/4804-19-0x0000000000140000-0x00000000001C1000-memory.dmp

Filesize
516KB

Download
memory/4804-39-0x0000000000140000-0x00000000001C1000-memory.dmp

Filesize
516KB

Download
memory/4804-13-0x0000000000140000-0x00000000001C1000-memory.dmp

Filesize
516KB

Download
memory/4804-14-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads