urelas | 67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe
Size

507KB
MD5

a9eaeb04e896a02140c7bbdbf5845a0e
SHA1

cbf857f9a0bf3a2db43d0320d3ea29f1914ac8c7
SHA256

67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd
SHA512

70dedcea8fcdbf85dc2eb9c40ec271ba207516b8074a4f8ba21d78dc1acb0c994e3d42d6d19af7e73d54e4dc6e2ce227d0f08cca1f6a439ffac43c322d642efc
SSDEEP

12288:Po7CGWcQSyYI2VrFKH5RBv9AQ1pEDdK5s:PMUv2LAv9AQ1p4dKC

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exeposup.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	posup.exe

Executes dropped EXE 2 IoCs

Processes:

posup.exeziqan.exe

pid	Process
3580	posup.exe
3860	ziqan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exeposup.execmd.exeziqan.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	posup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziqan.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ziqan.exe

pid	Process
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe
3860	ziqan.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exeposup.exe

description	pid	Process	procid_target
PID 3828 wrote to memory of 3580	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	87
PID 3828 wrote to memory of 3580	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	87
PID 3828 wrote to memory of 3580	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	87
PID 3828 wrote to memory of 4688	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	88
PID 3828 wrote to memory of 4688	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	88
PID 3828 wrote to memory of 4688	3828	67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe	88
PID 3580 wrote to memory of 3860	3580	posup.exe	102
PID 3580 wrote to memory of 3860	3580	posup.exe	102
PID 3580 wrote to memory of 3860	3580	posup.exe	102

C:\Users\Admin\AppData\Local\Temp\67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe
"C:\Users\Admin\AppData\Local\Temp\67069ade38948696e890bb072ab04ead3cd06e00bb05f90f0fd72463e66380dd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\posup.exe
  "C:\Users\Admin\AppData\Local\Temp\posup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\ziqan.exe
    "C:\Users\Admin\AppData\Local\Temp\ziqan.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
4f2811e676564ddbb1418c0c13b93823

SHA1
5461d02935c32866233c49abf1ccf2d870fb2567

SHA256
3fff7780a5f6d2b359102a3f8228706fd19310c0b23eba211c14e303b7f8cc49

SHA512
15bf5d91b68501e828066694747c78ca217df7d430416156565f47308899d969413e3e887d0cf717bc508f16d9230d9fc246342ce71c27e04bba289cef5b68fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
4f0eb6b6d87fb7975383d240ae396185

SHA1
b3905ec14621314b152bb2800005b929e486b08a

SHA256
e5ba9de095847f672e3402310ce67ec022ddb5cfa7968353d0dba5aad2177b25

SHA512
a2ed6f12cae07e1c91b6a657b3680d2b91daa026ffd97c87fb5369c67a91bd90b3c39a306396002f8284369bbf83f077bde174e470956926bbdf0cb8555d6153

Download Submit
C:\Users\Admin\AppData\Local\Temp\posup.exe

Filesize
507KB

MD5
e16d5950bb0d05b7887a953a04f4096f

SHA1
933d9a19cde1ac1a00d89d6989a9b9bd164c9fe5

SHA256
88785415776683083ce5ce28b97c34d2cd0156592bd642254a54b7e0abed4455

SHA512
4e3692726c62a82baaf386dc57f51d6d9633b1a2d5eb41ecd8b55c74ef76e0cf21fe7c6f307cd8ff55971c1f7a7af469b5f5ce2cef3186b669227cd91ca47148

Download Submit
C:\Users\Admin\AppData\Local\Temp\ziqan.exe

Filesize
172KB

MD5
c956095c638bda192eae829cbf37b4ab

SHA1
06eb6aebadd37f8f086aa9a30fe8b1162b07bd16

SHA256
1b0ced55cb91fb9cdb82b8c2b79f5d73e6871657592f060c29315b9a71069882

SHA512
635881f2b0f4f5b41525db6994569a01238f7f834c166056c0515b87898beef71d782f4d5ee375f0ede961eab5df2ffc68e0aa6bbb7a7767df71714a9be0a52e

Download Submit
memory/3580-28-0x0000000000070000-0x00000000000F1000-memory.dmp

Filesize
516KB

Download
memory/3580-17-0x0000000000070000-0x00000000000F1000-memory.dmp

Filesize
516KB

Download
memory/3580-12-0x0000000000070000-0x00000000000F1000-memory.dmp

Filesize
516KB

Download
memory/3828-14-0x0000000000AE0000-0x0000000000B61000-memory.dmp

Filesize
516KB

Download
memory/3828-0-0x0000000000AE0000-0x0000000000B61000-memory.dmp

Filesize
516KB

Download
memory/3860-26-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-27-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/3860-29-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-34-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/3860-33-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-35-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-36-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-37-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download
memory/3860-38-0x00000000009E0000-0x0000000000A79000-memory.dmp

Filesize
612KB

Download