urelas | be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb

General

Target

be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe
Size

333KB
MD5

23c77673328452fe83e7f4c9ffe44b48
SHA1

450b06237336098386446a853cd2d97477318acc
SHA256

be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb
SHA512

006f02d5ab0415f58223d9d4de20f11ad871df47ba5a552b5b9d8ce888f46bc0dcb39bb14a867f82cbb69f7e79819b27ea3f59fa3bf324284ec2a09c6ef8d8f9
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYVp:vHW138/iXWlK885rKlGSekcj66ciEp

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exepatud.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	patud.exe

Executes dropped EXE 2 IoCs

Processes:

patud.exesuqoz.exe

pid	Process
3180	patud.exe
1228	suqoz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exepatud.execmd.exesuqoz.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	suqoz.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

suqoz.exe

pid	Process
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe
1228	suqoz.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exepatud.exe

description	pid	Process	procid_target
PID 4244 wrote to memory of 3180	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	87
PID 4244 wrote to memory of 3180	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	87
PID 4244 wrote to memory of 3180	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	87
PID 4244 wrote to memory of 3044	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	88
PID 4244 wrote to memory of 3044	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	88
PID 4244 wrote to memory of 3044	4244	be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe	88
PID 3180 wrote to memory of 1228	3180	patud.exe	99
PID 3180 wrote to memory of 1228	3180	patud.exe	99
PID 3180 wrote to memory of 1228	3180	patud.exe	99

C:\Users\Admin\AppData\Local\Temp\be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe
"C:\Users\Admin\AppData\Local\Temp\be4e7d36a957f6effb39ee6e4c8fd1723de7cb3718685ad57755825466e204bb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\patud.exe
  "C:\Users\Admin\AppData\Local\Temp\patud.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\suqoz.exe
    "C:\Users\Admin\AppData\Local\Temp\suqoz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
63132647d862949de071464259a80592

SHA1
194a536fe3d16b8c5c7c6b07880e63a334e15e1d

SHA256
7421a8902a7ae484621e09766d63f157bcaaf48effee9a67812b547a38e006e9

SHA512
70d711de6db7b36c11e1b1cb35ba95e18e1df799b431da1e03d244b3b0a6045e10c565daa965c87ca393222c68eb7bee74281f3ae12d5f3f7016d8fae81d76a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1a03ac6a7e749f4585b35618e93f714e

SHA1
bba5f708fe74864da7fab7efc70520f14599ffe7

SHA256
9c3681f6e5cd71b4fba810b41584cf00049c44a329296984ecdfb747af70c829

SHA512
2473a0a383b81135ca76b9c7fa8170662d79516a3b4d737e89f68c2d4a4d385880e9acf607d8088f3f4ed53bd93a938b84ed9535d5a4dc575a9391f9d0dd8716

Download Submit
C:\Users\Admin\AppData\Local\Temp\patud.exe

Filesize
333KB

MD5
cf4feba99257237a230b9c95a3bd2a3c

SHA1
c3407357615c7c74717c891797950b60247e8295

SHA256
fd9b21ac2669ca25662ea34237872f9a77e028d13a9667dedb65a38497466ab4

SHA512
8e5437d143b2aaf0d0fe9f06d8f04c4909a9479b8907b52643cbb31b6e2bddcb248fa1431b5e2539622b98aca0ed87d7abc2ea8f0dd5240028f80d6e12560cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\suqoz.exe

Filesize
172KB

MD5
cb9cd504ccb323c1378deaae97ffd6df

SHA1
a67c01a54f6a36be84d1d7b2bffd0bb850bcf2cf

SHA256
46e464b8f49a64f1e20cb00a968e2dee5a3e753c3bedc29c8596fd66e99ec16a

SHA512
2eb661b0e907ac99ef6361d7ab1e5a6d3fcf16ccccb3eaaad1e60d3fa99c77fd46a344b6d81a8f066acaaf93b239b1941c2ccf816ca7c98416fe59fed5e0295c

Download Submit
memory/1228-37-0x0000000000F30000-0x0000000000F32000-memory.dmp

Filesize
8KB

Download
memory/1228-46-0x0000000000260000-0x00000000002F9000-memory.dmp

Filesize
612KB

Download
memory/1228-44-0x0000000000260000-0x00000000002F9000-memory.dmp

Filesize
612KB

Download
memory/1228-45-0x0000000000F30000-0x0000000000F32000-memory.dmp

Filesize
8KB

Download
memory/1228-40-0x0000000000260000-0x00000000002F9000-memory.dmp

Filesize
612KB

Download
memory/1228-36-0x0000000000260000-0x00000000002F9000-memory.dmp

Filesize
612KB

Download
memory/3180-14-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download
memory/3180-39-0x0000000000E10000-0x0000000000E91000-memory.dmp

Filesize
516KB

Download
memory/3180-19-0x0000000000E10000-0x0000000000E91000-memory.dmp

Filesize
516KB

Download
memory/3180-13-0x0000000000E10000-0x0000000000E91000-memory.dmp

Filesize
516KB

Download
memory/4244-16-0x0000000000C00000-0x0000000000C81000-memory.dmp

Filesize
516KB

Download
memory/4244-0-0x0000000000C00000-0x0000000000C81000-memory.dmp

Filesize
516KB

Download
memory/4244-1-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads