urelas | 4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30b

General

Target

4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe
Size

333KB
MD5

069769a12fb926841c133bd19fa34b30
SHA1

9904e2fc59e715aecc1540f459b248a74969334f
SHA256

4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30b
SHA512

ffabbb37b6a2d2264fa81ba5da6f489372db858cbeadc6185a1644a854ee6d0d9c37b5f93aa15b5f8480d632c04f36ed3ac7deb95854479985d2fe1d48476920
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYV7:vHW138/iXWlK885rKlGSekcj66ciE7

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exeuvose.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	uvose.exe

Executes dropped EXE 2 IoCs

Processes:

uvose.exejizuw.exe

pid process

1108 uvose.exe
436 jizuw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1108	uvose.exe
436	jizuw.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exeuvose.execmd.exejizuw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uvose.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jizuw.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

jizuw.exe

pid	process
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe
436	jizuw.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exeuvose.exe

description	pid	process	target process
PID 3548 wrote to memory of 1108	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	uvose.exe
PID 3548 wrote to memory of 1108	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	uvose.exe
PID 3548 wrote to memory of 1108	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	uvose.exe
PID 3548 wrote to memory of 1208	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	cmd.exe
PID 3548 wrote to memory of 1208	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	cmd.exe
PID 3548 wrote to memory of 1208	3548	4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe	cmd.exe
PID 1108 wrote to memory of 436	1108	uvose.exe	jizuw.exe
PID 1108 wrote to memory of 436	1108	uvose.exe	jizuw.exe
PID 1108 wrote to memory of 436	1108	uvose.exe	jizuw.exe

C:\Users\Admin\AppData\Local\Temp\4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe
"C:\Users\Admin\AppData\Local\Temp\4c641d122f193e8d0b37e23c679b575c5f4181adfc0b54031e60264e1c32a30bN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\uvose.exe
  "C:\Users\Admin\AppData\Local\Temp\uvose.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\jizuw.exe
    "C:\Users\Admin\AppData\Local\Temp\jizuw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
8f3321bf544322e77845fbb684c302ad

SHA1
280ad5cd953f1350d05b38de6ad8b8231cf461b8

SHA256
b9baeafa70d1f4e93eba4817536b9acbf60d8023638d9e94cb39a64baf6d4329

SHA512
36be1640cba4892da8b4c5bfe85a24a27e8f68c239db80b645cfd8206ec36792fb1eeed8c8d20f68a15e8eb6ec91c459ba3d20ab31969b076dc5eda9d2fbb3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
fa4499e108e685104c093226ee5b9fae

SHA1
b783a2abe2dceca260a4bb1c5fc1be79e43e242d

SHA256
59a35e4b0e35fbd388e813ff75a17349349bed7bcea7d701b971e6dba47c27a1

SHA512
cdaa7eaa58b11e018c13eb600e5fd0fe27753069ba54cf3a2d25ffb09539449086c241b9f65ba70030dc9488bdc8aa3afae6dfd5fc95efd0e6fe3720234c73a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\jizuw.exe

Filesize
172KB

MD5
677ec43573798ba46ccbf74fb1e765bf

SHA1
3d88aed30a440f6b3c87dc9e91d3d33ac275b870

SHA256
c2137eadd45d411bfb08d62ad9a3b3ee85f71fbdebb88ac3cfda25017cce3b92

SHA512
dc8d6bfba33d85bd61e2ca4959ea969498bf00d2912c090e22a206b75ca406831208c2821c8939bfd956a5589ac2742b0884283f55afb27e510bc49ca9d80e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvose.exe

Filesize
333KB

MD5
74a5774214395464323c1b9fb7125bc2

SHA1
4dfd07a2b92dfc026a4063439c9c7a018f618749

SHA256
58f79a669c4d9d5838e7613ac877a5ccac864e0ac6ebed37f67d20aa50a5efa3

SHA512
fa9c44e526ac8a8080e0f64042cfa0635cfcacff4a78c6e0fe315bb00f2892307280972b0fff573217b2c5e2bcaf5f35471bece855c81964d68806409256b98d

Download Submit
memory/436-38-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/436-47-0x00000000004E0000-0x0000000000579000-memory.dmp

Filesize
612KB

Download
memory/436-46-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/436-45-0x00000000004E0000-0x0000000000579000-memory.dmp

Filesize
612KB

Download
memory/436-39-0x00000000004E0000-0x0000000000579000-memory.dmp

Filesize
612KB

Download
memory/436-37-0x00000000004E0000-0x0000000000579000-memory.dmp

Filesize
612KB

Download
memory/1108-13-0x0000000000810000-0x0000000000891000-memory.dmp

Filesize
516KB

Download
memory/1108-20-0x0000000000810000-0x0000000000891000-memory.dmp

Filesize
516KB

Download
memory/1108-43-0x0000000000810000-0x0000000000891000-memory.dmp

Filesize
516KB

Download
memory/1108-15-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/3548-17-0x0000000000250000-0x00000000002D1000-memory.dmp

Filesize
516KB

Download
memory/3548-0-0x0000000000250000-0x00000000002D1000-memory.dmp

Filesize
516KB

Download
memory/3548-1-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads