urelas | c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe
Size

328KB
MD5

7278c271c2eef03467db27313917b658
SHA1

9629d2d11c22a6da39b2640759db5466900fdece
SHA256

c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44
SHA512

0a71c83047f23e4e451e9df2ce188bd6ea9f41e446b1add9e48118584c76d54cde3ad6252d38fcc4071e15e2bc6f2e0f5f1165112febe15b7d6022c1d2babf39
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMO0B:vHW138/iXWlK885rKlGSekcj66ciRB

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	fityb.exe

Executes dropped EXE 2 IoCs

pid	Process
3480	fityb.exe
1892	texin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	texin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fityb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe
1892	texin.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3480	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	89
PID 232 wrote to memory of 3480	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	89
PID 232 wrote to memory of 3480	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	89
PID 232 wrote to memory of 4424	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	90
PID 232 wrote to memory of 4424	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	90
PID 232 wrote to memory of 4424	232	c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe	90
PID 3480 wrote to memory of 1892	3480	fityb.exe	99
PID 3480 wrote to memory of 1892	3480	fityb.exe	99
PID 3480 wrote to memory of 1892	3480	fityb.exe	99

C:\Users\Admin\AppData\Local\Temp\c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe
"C:\Users\Admin\AppData\Local\Temp\c7f34fcf3ce0cd88cef94ad44beb049b47cd46ae487f882c3a42841949297e44.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\fityb.exe
  "C:\Users\Admin\AppData\Local\Temp\fityb.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\texin.exe
    "C:\Users\Admin\AppData\Local\Temp\texin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
3cf7fca461b272356871b22b0d6e9eea

SHA1
4f689d27d037d48e82c7ba213695752badc827a5

SHA256
a27fea47043be1d32f2e20feb1e66819f89eec3ac0288ace69885f47143aa31c

SHA512
ed5e1bce5d3b888ed948b61f6946f6cadacf010a8b6c43c12873669d9fabeed006c9b0f13bc6640fdbef4db99de23f86a3e2a7fd6c6ca87f6801ee2accedbdca

Download Submit
C:\Users\Admin\AppData\Local\Temp\fityb.exe

Filesize
328KB

MD5
5f9b91ab2975bcc57461979514e2f921

SHA1
73dc72f19923a60b54268538ba8184b5c8f5ccf4

SHA256
5788b5e8dcd82b146342cde53c6a83d502a0f87f54930e17abecd63a28db2576

SHA512
fe6aeed6fc2ff3112f0a7fca9225581e4a30ff88d943d742788bc80aaa9007e710372abde1fe3a05667d31e146b63bee057932fdb1f9ec47c1ed0f5e9dace0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
53ae848690da4ead072f7a8b6215c3ea

SHA1
6e0d4596d2bc3d04a8dda46b8a28be0de7493060

SHA256
2da9547e27734390a2012427842c2c00b9848d22a7cc076bce419ed1fb074273

SHA512
e293c228706c9598082c6e3a1959182431646a29bc4dcf046c17422cc15b944262450a769f5bdd253bc014af192aaa707715924ffb7771f09266cc757840b21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\texin.exe

Filesize
172KB

MD5
712c3464b97b7b405629521519cb01b5

SHA1
7a659332e443c6d2da5e33cfcd507bb4af315156

SHA256
bf3100c74b0d2d215b0398cba1d14e437b6ba4bad1decb52b785a047a0fa315e

SHA512
7e8e75bd9006f1c089fcdbbd326e00f8508841e577ec6f4e1514baadfb020ddfdc20083782e9133e350096874f373a40dbc50fb24fd3873c63324629e3a5f8f4

Download Submit
memory/232-17-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/232-1-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/232-0-0x00000000000C0000-0x0000000000141000-memory.dmp

Filesize
516KB

Download
memory/1892-41-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-39-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-42-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/1892-46-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-47-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-48-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-49-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/1892-50-0x00000000003D0000-0x0000000000469000-memory.dmp

Filesize
612KB

Download
memory/3480-20-0x0000000000B60000-0x0000000000BE1000-memory.dmp

Filesize
516KB

Download
memory/3480-21-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/3480-11-0x0000000000B60000-0x0000000000BE1000-memory.dmp

Filesize
516KB

Download
memory/3480-44-0x0000000000B60000-0x0000000000BE1000-memory.dmp

Filesize
516KB

Download
memory/3480-13-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download