urelas | 010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1

General

Target

010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
Size

334KB
MD5

d5362e12d9741ea3f79d6c9cd549c140
SHA1

c3f044b5004fdbfab46c97c9a5eafbb82b50440c
SHA256

010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1
SHA512

f64f5bcbc6e465ce3c92057048b0f7d9f9c868dff461f9118e8b94c3bd16b903ee0ba0477652bd23dacdaaa47092c1e5d145cf8b0829501ff4cae1ea6f3030cc
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYi:vHW138/iXWlK885rKlGSekcj66ciD

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2140	siwou.exe
2508	tasif.exe

Loads dropped DLL 2 IoCs

pid	Process
2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
2140	siwou.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	siwou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasif.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe
2508	tasif.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2140	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	30
PID 2136 wrote to memory of 2140	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	30
PID 2136 wrote to memory of 2140	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	30
PID 2136 wrote to memory of 2140	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	30
PID 2136 wrote to memory of 2712	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	31
PID 2136 wrote to memory of 2712	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	31
PID 2136 wrote to memory of 2712	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	31
PID 2136 wrote to memory of 2712	2136	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	31
PID 2140 wrote to memory of 2508	2140	siwou.exe	34
PID 2140 wrote to memory of 2508	2140	siwou.exe	34
PID 2140 wrote to memory of 2508	2140	siwou.exe	34
PID 2140 wrote to memory of 2508	2140	siwou.exe	34

C:\Users\Admin\AppData\Local\Temp\010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
"C:\Users\Admin\AppData\Local\Temp\010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\siwou.exe
  "C:\Users\Admin\AppData\Local\Temp\siwou.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\tasif.exe
    "C:\Users\Admin\AppData\Local\Temp\tasif.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
df76252114b22a7343fc46ca59adbce5

SHA1
4ab98ecc974d70fee19ef9924978f87aed4b4e0c

SHA256
ccf40eafa336d3a5d4a9d874dd2fdb7ec30913fed5d9a87b0cbd18cb8fca5d8f

SHA512
8562200481cd8e625e1fe0a0ba800f33ccb143996dd0324506b71b88d2c2b9b69045f8786f2c2d0060abfdaf74e28b526ba121696fa5436ceda659b0267ba270

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
30f408fb002efa803353dd75adcb7b79

SHA1
c5ed112e531cda19c8d39fb2d304655988c075c8

SHA256
a40124281e9a709718150bd9a9859a6e2de81239d2926b055f69a3b513d16615

SHA512
222676f3d1e940334dd7fd8ee7a7d7a20478e338589ba2c43270ce7a40a719e49bc55cc46c2fdd02179d8b0648c4757168cd400ff233d038b9d30112b65b4bca

Download Submit
\Users\Admin\AppData\Local\Temp\siwou.exe

Filesize
334KB

MD5
b0e6a2618cd3d80382a089c40bc53915

SHA1
47692f815479f3959afbe22c518b717368a20459

SHA256
13427921e0cd23e971c21fedc738f42e969d93f836e0a0766659a348b25d4b7f

SHA512
a63d0176fac9b1b60fbb3ca113e43278be4e499053a97ecf9c1fe1f3dd7ce9d7499764385c8e91287987c89fefe13a587e9939b130b2b1b14bca3a715e0e4afe

Download Submit
\Users\Admin\AppData\Local\Temp\tasif.exe

Filesize
172KB

MD5
d6376ac37f4b2173a13368978cd3d0ab

SHA1
465dbf679c0509a1640b7503aa04fe11de1f2681

SHA256
3005ff9863106bc08c2ad02a70255efd2e8d2eda17fd73acecc7f4819dd60466

SHA512
3baacadfb8c3f333779066e1808430114b029b87f19f14617c53b293d811ed6cc37539e9dc2ce0ea39abf21f285167eff41468cb8080342a0bb96fe8d7fc654d

Download Submit
memory/2136-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2136-0-0x00000000002C0000-0x0000000000341000-memory.dmp

Filesize
516KB

Download
memory/2136-10-0x0000000001DF0000-0x0000000001E71000-memory.dmp

Filesize
516KB

Download
memory/2136-21-0x00000000002C0000-0x0000000000341000-memory.dmp

Filesize
516KB

Download
memory/2140-11-0x0000000000830000-0x00000000008B1000-memory.dmp

Filesize
516KB

Download
memory/2140-25-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2140-24-0x0000000000830000-0x00000000008B1000-memory.dmp

Filesize
516KB

Download
memory/2140-12-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2140-40-0x0000000000830000-0x00000000008B1000-memory.dmp

Filesize
516KB

Download
memory/2508-43-0x0000000001050000-0x00000000010E9000-memory.dmp

Filesize
612KB

Download
memory/2508-42-0x0000000001050000-0x00000000010E9000-memory.dmp

Filesize
612KB

Download
memory/2508-47-0x0000000001050000-0x00000000010E9000-memory.dmp

Filesize
612KB

Download
memory/2508-48-0x0000000001050000-0x00000000010E9000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing