urelas | a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656

General

Target

a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe
Size

332KB
MD5

15afd1051690f222902f2f8b7a09c340
SHA1

3f61678e08e132620d6051dfd9b53ebb072d413e
SHA256

a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656
SHA512

a1f95390e52cc97b7ff3e6e9fb24577bc4190a3e6837b8d8ee28ed5801782dbe723b5d9d9e1e8d776fa7dc16d443d44646d90cea7751b218f1723c8bf30482f8
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYW:vHW138/iXWlK885rKlGSekcj66ciX

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dibyj.exe

Executes dropped EXE 2 IoCs

pid	Process
1556	dibyj.exe
716	vuhed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vuhed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dibyj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe
716	vuhed.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1556	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	90
PID 2612 wrote to memory of 1556	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	90
PID 2612 wrote to memory of 1556	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	90
PID 2612 wrote to memory of 4540	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	91
PID 2612 wrote to memory of 4540	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	91
PID 2612 wrote to memory of 4540	2612	a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe	91
PID 1556 wrote to memory of 716	1556	dibyj.exe	111
PID 1556 wrote to memory of 716	1556	dibyj.exe	111
PID 1556 wrote to memory of 716	1556	dibyj.exe	111

C:\Users\Admin\AppData\Local\Temp\a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe
"C:\Users\Admin\AppData\Local\Temp\a22fc411797fbf3e7c20f7ba4ce20e764d1b5402e9774dce6a8c835e329f5656N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\dibyj.exe
  "C:\Users\Admin\AppData\Local\Temp\dibyj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Users\Admin\AppData\Local\Temp\vuhed.exe
    "C:\Users\Admin\AppData\Local\Temp\vuhed.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
e5d4eb9ffc92f3ea80a72f698cbe544d

SHA1
b3400d7f5c96df17248a5880a4f0f1586534f344

SHA256
2b7a84315a440efa9d8ee5fab3ceca33c8a323f8e7bd90de9d596183ab22ee1c

SHA512
acd93355dbf8d2d78139aa87df9e194a665a059b74258caac2aadf2692b753355998213561f9edab3a9d694c3dc21bb90d165bdad558ffc86e18057dc5f620a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\dibyj.exe

Filesize
332KB

MD5
9fc4b7d2751f1f64479a38bc78ddc9f9

SHA1
0aee8010b947f18c9aefb0a01fa34746b6fc07ba

SHA256
741c4cea3f2e0ee3de6166f2413255c44890dcf91dfd1366619d5d2457af8bbb

SHA512
577be603d311d709bb7caba8a71bab1877355e1798eefb34511bb64af26459e12a52150ffe9975b26efa74595cf39ec7f10672a6c2a1daa19b1f5d01eee25f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
4f5563214dce3e6a6d5e060bc86c78b2

SHA1
e6cb43781ad70a61064ec7a570889f09093c0ffc

SHA256
42eb63287ff838eea4d685530ddd590a7649937acfd7774d03a39b1a71088e27

SHA512
b7b6c3e9f877cf9c2ff1efdf4bf831b59b21b6d71729813215202a72930853be13a52f94adc1fd8a793a62602e83bec8cf5358799969dc8bba5e3d921c0dc47c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuhed.exe

Filesize
172KB

MD5
7ccb30c801e54877ef2779543f5ad718

SHA1
48d6a246af42a91002d881a32dc83b92c0820ef3

SHA256
4726777a4db76e57ff0af2d12b69d07f7ebbe7895b84a962ac134eea5c76b4fa

SHA512
bcd87858a90b820a427dcb5631224f66cc7c29f4de1d2903092c0a36100ee61bc26deff5956c32299ad3b3fd2062c0169cab25220aaae287c96ea6feb5a5da24

Download Submit
memory/716-48-0x00000000006E0000-0x0000000000779000-memory.dmp

Filesize
612KB

Download
memory/716-46-0x00000000006E0000-0x0000000000779000-memory.dmp

Filesize
612KB

Download
memory/716-47-0x0000000000BC0000-0x0000000000BC2000-memory.dmp

Filesize
8KB

Download
memory/716-40-0x00000000006E0000-0x0000000000779000-memory.dmp

Filesize
612KB

Download
memory/716-39-0x0000000000BC0000-0x0000000000BC2000-memory.dmp

Filesize
8KB

Download
memory/716-38-0x00000000006E0000-0x0000000000779000-memory.dmp

Filesize
612KB

Download
memory/1556-12-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/1556-21-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/1556-20-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/1556-44-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/1556-13-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2612-17-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Filesize
516KB

Download
memory/2612-0-0x0000000000C70000-0x0000000000CF1000-memory.dmp

Filesize
516KB

Download
memory/2612-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing