urelas | fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270

General

Target

fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe
Size

326KB
MD5

cb2f0bb88d5b11b5b7efc71f55ee8eaa
SHA1

e94f72af58ebf1806d276fda558f7d7d3748eb71
SHA256

fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270
SHA512

318c91505d0999cf89241d31a3a90394606b32c1fd6d271e3acfb46eb23d4efb6d4cd9db3e14ba915ffe24940b969bff3f20e32c112a89e63ce04e304254ca0c
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYH:vHW138/iXWlK885rKlGSekcj66ci6

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2104 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

palun.exeberuu.exe

pid process

1748 palun.exe
2964 beruu.exe
Loads dropped DLL 2 IoCs

Processes:

fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exepalun.exe

pid process

2560 fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe
1748 palun.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2104	cmd.exe

pid	process
1748	palun.exe
2964	beruu.exe

pid	process
2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe
1748	palun.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exepalun.execmd.exeberuu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	palun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beruu.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

beruu.exe

pid	process
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe
2964	beruu.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exepalun.exe

description	pid	process	target process
PID 2560 wrote to memory of 1748	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	palun.exe
PID 2560 wrote to memory of 1748	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	palun.exe
PID 2560 wrote to memory of 1748	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	palun.exe
PID 2560 wrote to memory of 1748	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	palun.exe
PID 2560 wrote to memory of 2104	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	cmd.exe
PID 2560 wrote to memory of 2104	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	cmd.exe
PID 2560 wrote to memory of 2104	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	cmd.exe
PID 2560 wrote to memory of 2104	2560	fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe	cmd.exe
PID 1748 wrote to memory of 2964	1748	palun.exe	beruu.exe
PID 1748 wrote to memory of 2964	1748	palun.exe	beruu.exe
PID 1748 wrote to memory of 2964	1748	palun.exe	beruu.exe
PID 1748 wrote to memory of 2964	1748	palun.exe	beruu.exe

C:\Users\Admin\AppData\Local\Temp\fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe
"C:\Users\Admin\AppData\Local\Temp\fbe6326771cb0236b4bc19bf375f8a9526e00e57569b8652dcf71caf40f97270.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\palun.exe
  "C:\Users\Admin\AppData\Local\Temp\palun.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\beruu.exe
    "C:\Users\Admin\AppData\Local\Temp\beruu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
a0ff66e357e350b422bc8a3e8cf7880c

SHA1
7841b2937304e6d684f0066f43b7a24873ba3b26

SHA256
161080cc048732eed717b2cdae265a98ef72c55b24808338f10fa5237594c637

SHA512
b468a81c00a704d67cd2df7cfcb7be9a1b62cb58c1d1e74031f0935917c46b02bc22ff3d003a7a6d98c2c5c741903578efe6c4db63396c8d61f6a2eb9c0148d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
85a02327e4a713778edc7cf09fc6ce22

SHA1
43410a5f8fcdea2b7da3d2c371deb571cf9a0ca9

SHA256
974f230f00f7c5412e3dc223576f94d792c9786cab9ef0d19fb1ed98d40eaf4c

SHA512
50ee611c6e7928e89d1504448175110505d609284f809d69c9eca6cb748b18eaf7543180fed96f7145f5b2574a36b169d16a0331daf8fcea61b90e670fefbe06

Download Submit
\Users\Admin\AppData\Local\Temp\beruu.exe

Filesize
172KB

MD5
87f67b33939fa0f26baf78cfa1013f19

SHA1
ff74ab50c104897059430b87d827a6aad5b7097b

SHA256
f5eacd4fd9e0e1b598706326c698dffe4a5849b4294f163540c08f21b4431ab9

SHA512
8e6bb56f342125aa7114630880d154e5090392049b51e16e8fc1397c0345aa0df53d837a6e0aaeffd97dae1e250aafc28f897c6aeb14bd8c913730f715a552f4

Download Submit
\Users\Admin\AppData\Local\Temp\palun.exe

Filesize
326KB

MD5
e47be652c9ae4b13a528f8c7ce421a5d

SHA1
e9c2ef6414cb88ce3a15196e941f35293da779b3

SHA256
b8e7f3fdb76cb6c339d06d01bd7b247f145a137cd2eaa9c2db108d9b3c615da1

SHA512
1da24b1487edd88378b8c9eef6884e704f0afab3c13a9eaa1812ac131f38b11fa08805dca8130f192738ae9ab03b868f0efe92e627f54c263e2586882386ab88

Download Submit
memory/1748-24-0x0000000001100000-0x0000000001181000-memory.dmp

Filesize
516KB

Download
memory/1748-17-0x0000000001100000-0x0000000001181000-memory.dmp

Filesize
516KB

Download
memory/1748-39-0x0000000003920000-0x00000000039B9000-memory.dmp

Filesize
612KB

Download
memory/1748-19-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1748-41-0x0000000001100000-0x0000000001181000-memory.dmp

Filesize
516KB

Download
memory/2560-21-0x00000000009C0000-0x0000000000A41000-memory.dmp

Filesize
516KB

Download
memory/2560-0-0x00000000009C0000-0x0000000000A41000-memory.dmp

Filesize
516KB

Download
memory/2560-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2560-9-0x00000000005C0000-0x0000000000641000-memory.dmp

Filesize
516KB

Download
memory/2964-42-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-43-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-47-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-48-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-49-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-50-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download
memory/2964-51-0x0000000000A40000-0x0000000000AD9000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads