urelas | 111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7

General

Target

111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe
Size

333KB
MD5

3e1dbcc7e3805d50b0a4c74f3e0adf00
SHA1

83830eb0f615665b0eade43144fbbfc8bc92178b
SHA256

111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7
SHA512

0d737ad20eb071e8c4da7a8a6915500bc8e1fd441274f8a27d4193beea033c1e859406442972ef8680444eeb143111ff7a53c56ec9ebb9f82b53e2e7721899ca
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYe:vHW138/iXWlK885rKlGSekcj66ci7

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2332	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2192	tusee.exe
1716	hyugy.exe

Loads dropped DLL 2 IoCs

pid	Process
2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe
2192	tusee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tusee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hyugy.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe
1716	hyugy.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2192	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	30
PID 2568 wrote to memory of 2192	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	30
PID 2568 wrote to memory of 2192	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	30
PID 2568 wrote to memory of 2192	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	30
PID 2568 wrote to memory of 2332	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	31
PID 2568 wrote to memory of 2332	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	31
PID 2568 wrote to memory of 2332	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	31
PID 2568 wrote to memory of 2332	2568	111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe	31
PID 2192 wrote to memory of 1716	2192	tusee.exe	34
PID 2192 wrote to memory of 1716	2192	tusee.exe	34
PID 2192 wrote to memory of 1716	2192	tusee.exe	34
PID 2192 wrote to memory of 1716	2192	tusee.exe	34

C:\Users\Admin\AppData\Local\Temp\111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe
"C:\Users\Admin\AppData\Local\Temp\111c0686d08c0ff0ecf08a7c0e54b9a48e67da9903bcc9b56763b57b7e7a04c7N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\tusee.exe
  "C:\Users\Admin\AppData\Local\Temp\tusee.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\hyugy.exe
    "C:\Users\Admin\AppData\Local\Temp\hyugy.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
e0ad251730094b81ce3f28e9c15484d1

SHA1
d22bea5a5f72b202e9f4d7f0accce4de1ffeb74a

SHA256
ea754f1ac13ad6ad9e1f65fdbfaa3cc549ef395a6e2bf273d75d1043491121cc

SHA512
c550231c0d52218ad5013c1b016906c50c1444bc6cc44ef6e6ae8baa502c4880c0304bc6f87ce83b61112a242ac73aebe109af6d21b5db3e170e6824cf40967f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f33aaa73ff1f9472fb83d23d3822f9b4

SHA1
fc50f33703251f6fb76b1c44c1341fa912f9742b

SHA256
9cbb3f186b86c3e511fa8a8685a642f8b6d00cc88fe1ba49aef484c6537ded3a

SHA512
d9b13899b6b1da39fa2caca257bf394c9da241e45390dd16be97e32d83b0c136550f76fb667cd9f8a9c90fd53e6a1514060869eed8eaf1178f5c52eb90b55c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\tusee.exe

Filesize
333KB

MD5
83ed6fba506f0ea2630a7e1be0248559

SHA1
6d93b9743a8202bfe6a2542b7843f1b4c8202cd5

SHA256
0830399c7eeedcd0e807c225f130196f42c9a120a6202ddd4157e913205f04b4

SHA512
e289a17d821b81f23df616ccb05ce1570e77f3ac5f3f56e10aa510e801725e60a6d593841ef6afabe41a7ea6ef397db8fad74e27e1e3c23e0697337b734e3ea6

Download Submit
\Users\Admin\AppData\Local\Temp\hyugy.exe

Filesize
172KB

MD5
71f69a0f9ecb54c2c09e7e40a33994ae

SHA1
c843f5a4a90786dda21d5488951245c204edac32

SHA256
8f52ec3cd5176f9db7468bd339a9a2e7dcc4e3bf496dba8031826fce40b8efd5

SHA512
fbd30d904320238004ca4dc03aaf08baf494c99c4de1959564e3f02e4f44a3ee8425723206bb72cb0818be71fd583625031e601c46ed65c35c7765382deaed16

Download Submit
\Users\Admin\AppData\Local\Temp\tusee.exe

Filesize
333KB

MD5
ecdbdb03bb38cd944e0a3d265ebf6ce4

SHA1
4ba651eaeae97a35f15ec7b861b8c78957ff2023

SHA256
5c6decc2132475dc80ea3f11dc3b45956f97dc59108196dd9415fd45d7a7580a

SHA512
2e7adf8a152325a454875ee70d5fb2a67b9bb62dd77fde7ef5e1e5fa0181e81876f75c63c8338df53b13f8c8d715399e0ad748f251c253433249f8e4f5c1128f

Download Submit
memory/1716-40-0x0000000001030000-0x00000000010C9000-memory.dmp

Filesize
612KB

Download
memory/1716-41-0x0000000001030000-0x00000000010C9000-memory.dmp

Filesize
612KB

Download
memory/1716-46-0x0000000001030000-0x00000000010C9000-memory.dmp

Filesize
612KB

Download
memory/1716-47-0x0000000001030000-0x00000000010C9000-memory.dmp

Filesize
612KB

Download
memory/2192-12-0x0000000001180000-0x0000000001201000-memory.dmp

Filesize
516KB

Download
memory/2192-11-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2192-23-0x0000000001180000-0x0000000001201000-memory.dmp

Filesize
516KB

Download
memory/2192-39-0x0000000001180000-0x0000000001201000-memory.dmp

Filesize
516KB

Download
memory/2568-20-0x0000000000840000-0x00000000008C1000-memory.dmp

Filesize
516KB

Download
memory/2568-10-0x0000000002660000-0x00000000026E1000-memory.dmp

Filesize
516KB

Download
memory/2568-0-0x0000000000840000-0x00000000008C1000-memory.dmp

Filesize
516KB

Download
memory/2568-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing