urelas | 16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662

General

Target

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Size

332KB
MD5

c5105fd9f1ab2ad22f450fff55d33143
SHA1

e68a07e75bff28a4bf27567dfdef8bd519fb8a5a
SHA256

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662
SHA512

de98bee6a670b9b7e787e50786c75feecd647b3cde1dea6d01105f32b3271c61c4fbc881e7609f4ba33d0e36156117e430ab6f532e030c4550eb2147095f1670
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY6:vHW138/iXWlK885rKlGSekcj66cib

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	tylow.exe

Executes dropped EXE 2 IoCs

pid	Process
4860	tylow.exe
5104	tehos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tylow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tehos.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe
5104	tehos.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4860	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	86
PID 1192 wrote to memory of 4860	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	86
PID 1192 wrote to memory of 4860	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	86
PID 1192 wrote to memory of 2024	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	87
PID 1192 wrote to memory of 2024	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	87
PID 1192 wrote to memory of 2024	1192	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	87
PID 4860 wrote to memory of 5104	4860	tylow.exe	98
PID 4860 wrote to memory of 5104	4860	tylow.exe	98
PID 4860 wrote to memory of 5104	4860	tylow.exe	98

C:\Users\Admin\AppData\Local\Temp\16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
"C:\Users\Admin\AppData\Local\Temp\16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\tylow.exe
  "C:\Users\Admin\AppData\Local\Temp\tylow.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\tehos.exe
    "C:\Users\Admin\AppData\Local\Temp\tehos.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
f82b5e46ecc7199a4d77265ab29e761f

SHA1
471dc7642de247841861ef0047e6e73fe6e0509c

SHA256
8a106558acbed72ae6114bc0d074af4570578010fffa14854c5f703466ebd300

SHA512
bec787feeb03ebb2cc4477ffa405f3f39cdb02a85c134462f4907128c7fa82532c5a83ddd39f7a26a9b9a8084fb65ed2d7ee7d63e42ec779c7c63a3a89fc13b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
90fd435b236208fa71835369412ce1a4

SHA1
79dab955fffa2866f0d0f30a125ee7d4276d3e42

SHA256
57c834472c8cd48ab3ad3f65cd0dcaf2be3eea0ff25b6b45e7a9e12bbd52d375

SHA512
ddd5f5def1eff3ac7e9c8184ef1b99c190d456a3e70951a322357e594469e239ade7259510567ee2498e8f766d45b61f82e5323f211b5cfb80855b807b81ff2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tehos.exe

Filesize
172KB

MD5
fe891bc5a7d46a2ddd789aea5ec73091

SHA1
268a38df1042bcb4beae46e5c5f63a08d3826367

SHA256
adf385698752844ad701def43f00c9acc067fcdeaa34c16780a7016b3ad99203

SHA512
409e48ecd5ecafd5eecc4b0be749a2e12c3eca15fabee818ccb55b77af764f2518acea0be6f1c3b9a426ae9340c7a87be9190f60874d41548102a19b3dfcd446

Download Submit
C:\Users\Admin\AppData\Local\Temp\tylow.exe

Filesize
332KB

MD5
915a3e523d348100aed3a6a5f3761245

SHA1
161b419a35b6ee9e16d8ad90845ad279e88fef50

SHA256
5e4c2f9897fd743edb64f89838795c9341a4f78fb4e27774db67de5c8ab482e2

SHA512
8dc31604192b9babb8ffc6099cade5625b92f0ef94e79c657a5863805ef7cd447c3bea5add790cbeb004c780ff48b0ff62b264fb09ecea80a2ba17a9099bb148

Download Submit
memory/1192-1-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1192-0-0x0000000000690000-0x0000000000711000-memory.dmp

Filesize
516KB

Download
memory/1192-16-0x0000000000690000-0x0000000000711000-memory.dmp

Filesize
516KB

Download
memory/4860-19-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4860-13-0x0000000000BE0000-0x0000000000C61000-memory.dmp

Filesize
516KB

Download
memory/4860-20-0x0000000000BE0000-0x0000000000C61000-memory.dmp

Filesize
516KB

Download
memory/4860-14-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4860-40-0x0000000000BE0000-0x0000000000C61000-memory.dmp

Filesize
516KB

Download
memory/5104-38-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/5104-37-0x00000000009F0000-0x0000000000A89000-memory.dmp

Filesize
612KB

Download
memory/5104-41-0x00000000009F0000-0x0000000000A89000-memory.dmp

Filesize
612KB

Download
memory/5104-45-0x00000000009F0000-0x0000000000A89000-memory.dmp

Filesize
612KB

Download
memory/5104-46-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/5104-47-0x00000000009F0000-0x0000000000A89000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing