urelas | 010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1

General

Target

010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
Size

334KB
MD5

d5362e12d9741ea3f79d6c9cd549c140
SHA1

c3f044b5004fdbfab46c97c9a5eafbb82b50440c
SHA256

010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1
SHA512

f64f5bcbc6e465ce3c92057048b0f7d9f9c868dff461f9118e8b94c3bd16b903ee0ba0477652bd23dacdaaa47092c1e5d145cf8b0829501ff4cae1ea6f3030cc
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYi:vHW138/iXWlK885rKlGSekcj66ciD

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	atbun.exe

Executes dropped EXE 2 IoCs

pid	Process
3752	atbun.exe
1652	keryd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keryd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atbun.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe
1652	keryd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3752	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	88
PID 1032 wrote to memory of 3752	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	88
PID 1032 wrote to memory of 3752	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	88
PID 1032 wrote to memory of 1704	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	89
PID 1032 wrote to memory of 1704	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	89
PID 1032 wrote to memory of 1704	1032	010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe	89
PID 3752 wrote to memory of 1652	3752	atbun.exe	107
PID 3752 wrote to memory of 1652	3752	atbun.exe	107
PID 3752 wrote to memory of 1652	3752	atbun.exe	107

C:\Users\Admin\AppData\Local\Temp\010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe
"C:\Users\Admin\AppData\Local\Temp\010f129bfed164ec03c59568036c577b10a67a316d26d10ad2a0ce3af3bcceb1N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\atbun.exe
  "C:\Users\Admin\AppData\Local\Temp\atbun.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\keryd.exe
    "C:\Users\Admin\AppData\Local\Temp\keryd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
df76252114b22a7343fc46ca59adbce5

SHA1
4ab98ecc974d70fee19ef9924978f87aed4b4e0c

SHA256
ccf40eafa336d3a5d4a9d874dd2fdb7ec30913fed5d9a87b0cbd18cb8fca5d8f

SHA512
8562200481cd8e625e1fe0a0ba800f33ccb143996dd0324506b71b88d2c2b9b69045f8786f2c2d0060abfdaf74e28b526ba121696fa5436ceda659b0267ba270

Download Submit
C:\Users\Admin\AppData\Local\Temp\atbun.exe

Filesize
334KB

MD5
57fae52333644b57607ef64f7dcddde2

SHA1
a293802a91cf8e9257e54cfc934b06300429eab2

SHA256
c5d343e31532c621222e34da5754cf1680fc7a938efea045c89386d593d897b8

SHA512
bc7b294cbecd2ad28027886ea9c12b57a96d238c6ae1f4c639966665284c3656f1ca1773d2efec41fa3e406c9815bc4c5e8d0f68bdc943a40e50253c7d553534

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a5904d615b817b57c0916944762ad5ad

SHA1
e2f87be89bb18958c0f5e6c4eb4d27c9f4ab3bd1

SHA256
7b84f9384df4b16ee146c20bc116765a8ec1d04fe54fc3db99c49666a6c37995

SHA512
71eda9e3a8f1ffc89bd0b78987c5f5b38572450e9d4618948aac54490e2f52b661b98eb159fe851130e9da17dc9ef352ea274002a496924dda943678ba817dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\keryd.exe

Filesize
172KB

MD5
8c06b8039de2cdd53f55c25636878030

SHA1
09aef6038ab519ff3b12bbc8aecac673d3e253ba

SHA256
72a8d5a6e7bd64dd60d66ca3f80aa24fa06447b10794c74ba530dd38828054fd

SHA512
e8b5f7c82d1cf67127e6051708ac16e28f80b39599555c09a44135a7a26ffc7f1efe58d310e52449f9263acaf8188ceb7a80c1b4c21ba5603fd36b36034f78ba

Download Submit
memory/1032-0-0x0000000000A70000-0x0000000000AF1000-memory.dmp

Filesize
516KB

Download
memory/1032-17-0x0000000000A70000-0x0000000000AF1000-memory.dmp

Filesize
516KB

Download
memory/1032-1-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1652-47-0x0000000000D80000-0x0000000000E19000-memory.dmp

Filesize
612KB

Download
memory/1652-45-0x0000000000D80000-0x0000000000E19000-memory.dmp

Filesize
612KB

Download
memory/1652-46-0x0000000000D00000-0x0000000000D02000-memory.dmp

Filesize
8KB

Download
memory/1652-37-0x0000000000D80000-0x0000000000E19000-memory.dmp

Filesize
612KB

Download
memory/1652-39-0x0000000000D80000-0x0000000000E19000-memory.dmp

Filesize
612KB

Download
memory/1652-38-0x0000000000D00000-0x0000000000D02000-memory.dmp

Filesize
8KB

Download
memory/3752-13-0x00000000005C0000-0x0000000000641000-memory.dmp

Filesize
516KB

Download
memory/3752-43-0x00000000005C0000-0x0000000000641000-memory.dmp

Filesize
516KB

Download
memory/3752-20-0x00000000005C0000-0x0000000000641000-memory.dmp

Filesize
516KB

Download
memory/3752-14-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing