urelas | 7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe
Size

427KB
MD5

9f5a76606f02cc96ed2530eb6ba13c7f
SHA1

40e448fe4bba1f92069e518706a0433417a07c37
SHA256

7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5
SHA512

c39c57ed0dea297553a659187fd72c89a70dcd68b20830c89a22851919081e3a5c72ca7aeeeb1844116dd70783a179e7224188fcd96ecd5a5cec440bd24e89cb
SSDEEP

6144:EKbwhNxUjDVMytD2NkWuRk/oBmodd+sAaTmQo2fkKv:vANxU3VH1t19MsAlpXG

Score

10^/10

urelas aspackv2 discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x0004000000004ed7-27.dat	aspack_v212_v242

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2516	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

denuz.exetylap.exe

pid	Process
2548	denuz.exe
1988	tylap.exe

Loads dropped DLL 3 IoCs

Processes:

7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exedenuz.exe

pid	Process
2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe
2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe
2548	denuz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tylap.exe7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exedenuz.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tylap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	denuz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

tylap.exe

pid	Process
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe
1988	tylap.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exedenuz.exe

description	pid	Process	procid_target
PID 2064 wrote to memory of 2548	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	30
PID 2064 wrote to memory of 2548	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	30
PID 2064 wrote to memory of 2548	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	30
PID 2064 wrote to memory of 2548	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	30
PID 2064 wrote to memory of 2516	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	31
PID 2064 wrote to memory of 2516	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	31
PID 2064 wrote to memory of 2516	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	31
PID 2064 wrote to memory of 2516	2064	7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe	31
PID 2548 wrote to memory of 1988	2548	denuz.exe	34
PID 2548 wrote to memory of 1988	2548	denuz.exe	34
PID 2548 wrote to memory of 1988	2548	denuz.exe	34
PID 2548 wrote to memory of 1988	2548	denuz.exe	34

C:\Users\Admin\AppData\Local\Temp\7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe
"C:\Users\Admin\AppData\Local\Temp\7c6cbbd4cc596f17474662240ca740a05593f42401575b27fda1b2c19a12aff5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\denuz.exe
  "C:\Users\Admin\AppData\Local\Temp\denuz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\tylap.exe
    "C:\Users\Admin\AppData\Local\Temp\tylap.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
8f00f73dc2327194b161ef418fc93c13

SHA1
17b54cb67ce70cf225e7807ee1dc5eaf5c1412bc

SHA256
0069ed5fe201679710c34e0ba7dc99358b5fefe1f6ed1fe3f446ea044e9f1e7b

SHA512
b67f29190dd78ab220832fd9a7f4a1a7ad801593d29da13bf9ad5c5dea1a645aacf25bfb25e3dbd1b9ae1e7c0e5e9ed16950897ce755e2fd6e397a2b1cb03b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
6e7f0c053784b16cd8a9e79c2bee9dbc

SHA1
77fc7c9395ed9eb8ba5616fcd163a78c028f32d8

SHA256
0115ad9c31af66e19f77e5828e96e640d4a1666a7097134446deab4dc2506ce4

SHA512
f245e732a90391479ffb5530c7f3d8cbff084c49373cb4332ccde1b7028759953f8f6af38f41267624cb4b0d41a180b3f8129bab30f32c568b104270b1665635

Download Submit
\Users\Admin\AppData\Local\Temp\denuz.exe

Filesize
427KB

MD5
e10a2b08c3f166bf55da73a55a27574b

SHA1
9d42ab7f9ce715d1562b12ef51a0d3dda44e4f76

SHA256
468b7c1502a23fa499220f12db17ff36fa0f21b6854f3819601ead4c5d4aef28

SHA512
17cdb80684ef13e423e22e7efa7e5f7085053814d5edb65bc3aa401f589d3c0d0ac895c99ee64419b4724e699ebd342e821dbfc3cf8bda8032809e1094633b4d

Download Submit
\Users\Admin\AppData\Local\Temp\tylap.exe

Filesize
216KB

MD5
25971740d6b346fe2de9d7949b386d2c

SHA1
182e2c6cf17ad4bb98a662500f25e2e6b96df3f8

SHA256
baab68ab082d1aeb74ae678a8767fad00e44895aa4afe48d24c4342d2fd2f6e4

SHA512
ec048fd71e514cf6d15874b52b045aaca13d340310ea5044e26270d665d6614e09b5b54582bf65b75ac838845176a20853fc495fe334fa9b4826a182505bc6f0

Download Submit
memory/1988-39-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-41-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-32-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-40-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-35-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-34-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-33-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-37-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/1988-38-0x00000000010F0000-0x0000000001192000-memory.dmp

Filesize
648KB

Download
memory/2064-21-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2064-11-0x00000000025D0000-0x0000000002638000-memory.dmp

Filesize
416KB

Download
memory/2064-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2548-24-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2548-31-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2548-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download