urelas | a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429

General

Target

a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe
Size

332KB
MD5

926d44f877c6b8877309b7dc186c5650
SHA1

d21eb91f9d20bb0d3a3ccd5edd4dd48d900a54df
SHA256

a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429
SHA512

486b60f8b1ee93f7b52f8f911e4284b7c384a23a68e4736d5fd6b9dd97c1be5cae23f24fce95f11c98e954bfb029ef55d84bab57dcc9fbbeda6a61e4b6548fc2
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVO:vHW138/iXWlK885rKlGSekcj66ciEO

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exenunyu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	nunyu.exe

Executes dropped EXE 2 IoCs

Processes:

nunyu.exejares.exe

pid process

2940 nunyu.exe
1940 jares.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2940	nunyu.exe
1940	jares.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exenunyu.execmd.exejares.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nunyu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jares.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jares.exe

pid	process
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe
1940	jares.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exenunyu.exe

description	pid	process	target process
PID 3076 wrote to memory of 2940	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	nunyu.exe
PID 3076 wrote to memory of 2940	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	nunyu.exe
PID 3076 wrote to memory of 2940	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	nunyu.exe
PID 3076 wrote to memory of 2888	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	cmd.exe
PID 3076 wrote to memory of 2888	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	cmd.exe
PID 3076 wrote to memory of 2888	3076	a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe	cmd.exe
PID 2940 wrote to memory of 1940	2940	nunyu.exe	jares.exe
PID 2940 wrote to memory of 1940	2940	nunyu.exe	jares.exe
PID 2940 wrote to memory of 1940	2940	nunyu.exe	jares.exe

C:\Users\Admin\AppData\Local\Temp\a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe
"C:\Users\Admin\AppData\Local\Temp\a75ad7afda019d2648d07451bdc13beffe0afe240b2def24e3312e6c9eb51429.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\nunyu.exe
  "C:\Users\Admin\AppData\Local\Temp\nunyu.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\jares.exe
    "C:\Users\Admin\AppData\Local\Temp\jares.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
50cdf9e4b573a86d4510dec0488fd72e

SHA1
24b5ae9f6b068455895b878569eabbcdd113a0bb

SHA256
2eb2fe28da4522c3f19a396b64cf2fcf1c9d3c242a60b7beb332abc2a2a57ef1

SHA512
d8e3fe0c00f225698bc8bea1184466552f46a26b1d8ad31ff968d5b64afb0c3e4aa43d8c8677a058272f3cf90c942f7d380452f1b11b8a177efca92a13e55b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
b846d545220909344b853a4521ed7798

SHA1
3770283b6985ca80f85d3dece12eff8990defb3e

SHA256
380e69eb0719c2f1fa8c204230c923ab6f73f9a281b90664696193654ce1d61c

SHA512
921a1d53f783e6c85a21468ed7aa60d58e83ab7dde90818b7eb8ed6abdfd4fa712fa88ae642878108018a35a2199d08de3cda8c455383aabbffeef9801923c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\jares.exe

Filesize
172KB

MD5
73ab6465c553641cf48879b6d0442b6a

SHA1
124114d16b51aa1a60a27fee191cad8699675c73

SHA256
fa9dceb61efdae4c8c8d2f75713c950be5ee02c403a3a66504944ba41971bda8

SHA512
1d3898b048f12a1dd9a4d0f75b4961bcdced29dc53309538f3bc974f983635a4cf4725469f80732b560c869acb3bbb5f9260de2a405ef7220d4febe4d932035b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nunyu.exe

Filesize
332KB

MD5
e713187e71a717b5c1f1c2927eb0d75f

SHA1
d3df52aabd15639e977bc9edc5246207b6104402

SHA256
9db8bb03690af617dfa667aa7701b9ba3b152ae783904d26096e669e4ca3d371

SHA512
f31a20bd2bb4513233fa53c859de2e621d177acd0c69adbe8582142cadae93a2228df3d06e98f53605c392e200311ea75f13d0f11b4971c85a5e9738879b79fe

Download Submit
memory/1940-48-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-47-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-46-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-49-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-44-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-40-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/1940-45-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/1940-37-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/1940-36-0x00000000009A0000-0x0000000000A39000-memory.dmp

Filesize
612KB

Download
memory/2940-39-0x0000000000B30000-0x0000000000BB1000-memory.dmp

Filesize
516KB

Download
memory/2940-19-0x0000000000B30000-0x0000000000BB1000-memory.dmp

Filesize
516KB

Download
memory/2940-13-0x0000000000B30000-0x0000000000BB1000-memory.dmp

Filesize
516KB

Download
memory/2940-14-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3076-0-0x0000000000C20000-0x0000000000CA1000-memory.dmp

Filesize
516KB

Download
memory/3076-16-0x0000000000C20000-0x0000000000CA1000-memory.dmp

Filesize
516KB

Download
memory/3076-1-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads