urelas | c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1

General

Target

c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe
Size

333KB
MD5

b73a1d20ba44fc157c979919730d53b0
SHA1

68decb89026da30677cb4a15bfc06fd6731fcc43
SHA256

c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1
SHA512

885e5a1a60ea24c48a0532833c7c0254665d119c53dfc6ede7c929cbf408450235ba9bc295e0eb8e26ec0587c414795c061288bab0d51a5aa4237925e9e09c08
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY9D:vHW138/iXWlK885rKlGSekcj66ciWD

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	lokyt.exe

Executes dropped EXE 2 IoCs

pid	Process
1628	lokyt.exe
1284	morii.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lokyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	morii.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe
1284	morii.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 1628	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	88
PID 3428 wrote to memory of 1628	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	88
PID 3428 wrote to memory of 1628	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	88
PID 3428 wrote to memory of 3980	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	89
PID 3428 wrote to memory of 3980	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	89
PID 3428 wrote to memory of 3980	3428	c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe	89
PID 1628 wrote to memory of 1284	1628	lokyt.exe	100
PID 1628 wrote to memory of 1284	1628	lokyt.exe	100
PID 1628 wrote to memory of 1284	1628	lokyt.exe	100

C:\Users\Admin\AppData\Local\Temp\c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe
"C:\Users\Admin\AppData\Local\Temp\c894b6d294b57a79f7f2a1724559625acb76ad59487d4944991c15e8cc364ee1N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\lokyt.exe
  "C:\Users\Admin\AppData\Local\Temp\lokyt.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\morii.exe
    "C:\Users\Admin\AppData\Local\Temp\morii.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
c326a90cd16d97acc9229102e6666204

SHA1
93c2b71d8d210da2c5cd2ea5b147eba0cad85022

SHA256
887a78279680dece945f2b3f1f84e4e071a035b5d3be545b22b87d272c1f8d5b

SHA512
f7a3401e4684c1f1fb50ee2265dcd21dd952f11c2b9149362f5f9f4ce1c8cc6c227e284d373a79294dc6c4abf03dd31d1dfed7e5bba99ac2a2655cd829343a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
ae9b9f58c3b41c53eed8c390fdacfb23

SHA1
cd30d535b2f04db2ea5f7c754a1d71224a0a6236

SHA256
bbf8976546924822dc54ec02894b15cf1a26809e3b581bf9fb5d74e3c0d252fc

SHA512
397e3a210219a04a0bc2d3aab9352fe895d44913b44b442b2cb2c557e86e058dd8f16b9e4805b930559ac562be99d19706401b4ad342743fb9825521847bf7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lokyt.exe

Filesize
333KB

MD5
cc899020146fefed1abba937cb69500b

SHA1
0defdac881a04ca02e92562d8024fce29badee3c

SHA256
4fab563608d34e6646a1dd350ceb35e488229c281daa1fba83de5ad4f2019013

SHA512
e23c8164ab53f940fb533aa8624c100db96f4913510b4a884a9395493649b36815a947fc73811ed09c8797af7abcccf42328f0a30aa7a3a81d163104fd111f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\morii.exe

Filesize
172KB

MD5
5e5e59717c0d351376726fd8de109ca7

SHA1
f8c3cb07554278abb35155826d541bb1f7b04ed6

SHA256
1c33499f0bd4af148ef004832a3036f85c162716a1e9f73119f8dc42b43f9e35

SHA512
fd61678a0b9a7eac9bac995feaed768feaed36a8787a8aec058ed95f05991906deb2d9ff947dde03bb1e617633d3ece8c3b6de1e928b9dedd49f775dd0177354

Download Submit
memory/1284-40-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/1284-47-0x0000000000AA0000-0x0000000000B39000-memory.dmp

Filesize
612KB

Download
memory/1284-45-0x0000000000AA0000-0x0000000000B39000-memory.dmp

Filesize
612KB

Download
memory/1284-46-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/1284-41-0x0000000000AA0000-0x0000000000B39000-memory.dmp

Filesize
612KB

Download
memory/1284-37-0x0000000000AA0000-0x0000000000B39000-memory.dmp

Filesize
612KB

Download
memory/1628-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1628-38-0x0000000000300000-0x0000000000381000-memory.dmp

Filesize
516KB

Download
memory/1628-20-0x0000000000300000-0x0000000000381000-memory.dmp

Filesize
516KB

Download
memory/1628-13-0x0000000000300000-0x0000000000381000-memory.dmp

Filesize
516KB

Download
memory/3428-17-0x0000000000320000-0x00000000003A1000-memory.dmp

Filesize
516KB

Download
memory/3428-0-0x0000000000320000-0x00000000003A1000-memory.dmp

Filesize
516KB

Download
memory/3428-1-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing