urelas | 7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
Size

332KB
MD5

f6635ac29f607998a4c7725fd5eede20
SHA1

cc6eeea7c353e6010700722b37c7a77eb649ccfb
SHA256

7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8
SHA512

07f5074208431a97fe3844bc21c10e2ccfeb3ca480f9ed4076592715c8d64c01773129a26545585dad671b54f84b57c2b67a6708cfad05dc83353c3ec191d9af
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVr:vHW138/iXWlK885rKlGSekcj66ciEr

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2504	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1728	fuevj.exe
1976	tibey.exe

Loads dropped DLL 2 IoCs

pid	Process
2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
1728	fuevj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fuevj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tibey.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe
1976	tibey.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1728	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	30
PID 2412 wrote to memory of 1728	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	30
PID 2412 wrote to memory of 1728	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	30
PID 2412 wrote to memory of 1728	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	30
PID 2412 wrote to memory of 2504	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	31
PID 2412 wrote to memory of 2504	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	31
PID 2412 wrote to memory of 2504	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	31
PID 2412 wrote to memory of 2504	2412	7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe	31
PID 1728 wrote to memory of 1976	1728	fuevj.exe	34
PID 1728 wrote to memory of 1976	1728	fuevj.exe	34
PID 1728 wrote to memory of 1976	1728	fuevj.exe	34
PID 1728 wrote to memory of 1976	1728	fuevj.exe	34

C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe
"C:\Users\Admin\AppData\Local\Temp\7d2b119d7cb9ed16f0367f444331cccbae5c5092032887561ff660c95472f2f8N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\fuevj.exe
  "C:\Users\Admin\AppData\Local\Temp\fuevj.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\tibey.exe
    "C:\Users\Admin\AppData\Local\Temp\tibey.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
20d0dde02cbbca0903749e4033bae8c5

SHA1
d19da8243bce36f392e29c56aa674b3f01b9fe2d

SHA256
c3c9fcbb0cf750025fb87e4492d8e7766d079096fed6bbbd1971ea202732a3e5

SHA512
0e2070fd38799a0b1d8524604599c22b28327712d18042dced09e41ee176c18bfa16152209ff73c7828149dd6865dffa0504f35c945dae44db6f2fc0b1be2619

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
b91260f31e3d59988d9bc73bcc7ad7ce

SHA1
821629b1fefe32c8c78c93fb8f39ca3498155908

SHA256
e897e5eb4963633290a423e2cd3adb2c59d76de1cf54ea3914a8028c9920843b

SHA512
38f9b289c6d62436ac809a1e6f0074edc15c102232de8eeafe07db77a4a79aa730dc97ffac98076ffe084de40bf5d7640409ba4c8155a572410f84678daeffdd

Download Submit
\Users\Admin\AppData\Local\Temp\fuevj.exe

Filesize
332KB

MD5
840428113d7d722cab072f632d9dbcbe

SHA1
77d318a4452e26c4368a03b1ad03cb375b630b05

SHA256
99d898a10d43f7080e085266be90f28c955eab7dd67808958611c601b9e192d9

SHA512
0c9cec873acdabe719f5743428a89b1b1992bee4776729394fc0ed4ac85d85a08e2f476726939a82c35b589fefb7828d2b6d2900aa30ac85ee133dee3fd5bb72

Download Submit
\Users\Admin\AppData\Local\Temp\tibey.exe

Filesize
172KB

MD5
aba3ea1e556456a9ce9fb4e836d2d282

SHA1
437bdb49f5839933bd4e73a0b4ffec0a2af5bd87

SHA256
2fbb56f0cbd6c8650598c4bd6f03d97a8cfd20d24f94400d83bd8cf40226ccf6

SHA512
8ffdb5ce49efdd2da2108eb9faee455cf344ce45f8cce1db096be9ed9e312f935e8862f2e414ba40fc93850a6b9559e4103e7611167c3d46053c867f9e98c3a0

Download Submit
memory/1728-25-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1728-42-0x0000000000240000-0x00000000002C1000-memory.dmp

Filesize
516KB

Download
memory/1728-19-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1728-38-0x00000000032D0000-0x0000000003369000-memory.dmp

Filesize
612KB

Download
memory/1728-12-0x0000000000240000-0x00000000002C1000-memory.dmp

Filesize
516KB

Download
memory/1728-24-0x0000000000240000-0x00000000002C1000-memory.dmp

Filesize
516KB

Download
memory/1976-43-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-44-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-48-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-49-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-50-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-51-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/1976-52-0x0000000000A20000-0x0000000000AB9000-memory.dmp

Filesize
612KB

Download
memory/2412-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2412-0-0x00000000003B0000-0x0000000000431000-memory.dmp

Filesize
516KB

Download
memory/2412-9-0x00000000024E0000-0x0000000002561000-memory.dmp

Filesize
516KB

Download
memory/2412-21-0x00000000003B0000-0x0000000000431000-memory.dmp

Filesize
516KB

Download