urelas | 16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Size

332KB
MD5

c5105fd9f1ab2ad22f450fff55d33143
SHA1

e68a07e75bff28a4bf27567dfdef8bd519fb8a5a
SHA256

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662
SHA512

de98bee6a670b9b7e787e50786c75feecd647b3cde1dea6d01105f32b3271c61c4fbc881e7609f4ba33d0e36156117e430ab6f532e030c4550eb2147095f1670
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XY6:vHW138/iXWlK885rKlGSekcj66cib

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exerokuf.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	rokuf.exe

Executes dropped EXE 2 IoCs

Processes:

rokuf.exexozyd.exe

pid	Process
2516	rokuf.exe
4400	xozyd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exerokuf.execmd.exexozyd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rokuf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xozyd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

xozyd.exe

pid	Process
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe
4400	xozyd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exerokuf.exe

description	pid	Process	procid_target
PID 2752 wrote to memory of 2516	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	88
PID 2752 wrote to memory of 2516	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	88
PID 2752 wrote to memory of 2516	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	88
PID 2752 wrote to memory of 3120	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	89
PID 2752 wrote to memory of 3120	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	89
PID 2752 wrote to memory of 3120	2752	16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe	89
PID 2516 wrote to memory of 4400	2516	rokuf.exe	106
PID 2516 wrote to memory of 4400	2516	rokuf.exe	106
PID 2516 wrote to memory of 4400	2516	rokuf.exe	106

C:\Users\Admin\AppData\Local\Temp\16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe
"C:\Users\Admin\AppData\Local\Temp\16261fb3a703ef33965fc35d7230b5f0ca970b9e02377f20faabf7be3f5f3662.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\rokuf.exe
  "C:\Users\Admin\AppData\Local\Temp\rokuf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\xozyd.exe
    "C:\Users\Admin\AppData\Local\Temp\xozyd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
f82b5e46ecc7199a4d77265ab29e761f

SHA1
471dc7642de247841861ef0047e6e73fe6e0509c

SHA256
8a106558acbed72ae6114bc0d074af4570578010fffa14854c5f703466ebd300

SHA512
bec787feeb03ebb2cc4477ffa405f3f39cdb02a85c134462f4907128c7fa82532c5a83ddd39f7a26a9b9a8084fb65ed2d7ee7d63e42ec779c7c63a3a89fc13b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1ebe69f4e62b736c977d4cbd13660f55

SHA1
1aa456cbd34ceb594ceca0d5a398c5b9f30a5b88

SHA256
af96bfbd76980a331b635cd7869fed1941c84ea12fe0d746873150f116e0e402

SHA512
c0e8c6ca0571d26c229da8e41a935c712bf275621c9a86f5f432095541e78a3793691d709eb7f2a1e1a7c2d8fd09142acf4cbf88f5dda7a68fda08735417bf51

Download Submit
C:\Users\Admin\AppData\Local\Temp\rokuf.exe

Filesize
332KB

MD5
b4a2f9cd4cf728f63e0af21794c9b889

SHA1
1a253bb7a7cf30413c78fbe7a433c26d2667bf66

SHA256
8018dc5419c76c9b7834845ff37ea418b27e12bf43681c3265bd0f1f4066912d

SHA512
ec8e99e781da347de1fa6c3f55c6190bc8cb76cd63d977d872e2f947b4aa720c7f4cabf1672e9edc7c404cd85ee53f3eff356a67cfdf951079e764cc00582952

Download Submit
C:\Users\Admin\AppData\Local\Temp\xozyd.exe

Filesize
172KB

MD5
c8c5951ac99b7e8b2b1dc6eecbefe855

SHA1
95f344400da686bc059af815b91a960861db4e2a

SHA256
f1f1c7133a00a3a9bbcccf8069891792d8c4a3a8fffef114a7cb3b798345f69f

SHA512
3ccc3dda0a746484c8801d20052a492ed869d50ef202204aa11a5470b02287b8ab70ec95e64ebb6a777151413ab519a23887e5ce7210c38a47ca286da721544d

Download Submit
memory/2516-21-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2516-40-0x0000000000690000-0x0000000000711000-memory.dmp

Filesize
516KB

Download
memory/2516-12-0x0000000000690000-0x0000000000711000-memory.dmp

Filesize
516KB

Download
memory/2516-13-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2516-20-0x0000000000690000-0x0000000000711000-memory.dmp

Filesize
516KB

Download
memory/2752-17-0x0000000000700000-0x0000000000781000-memory.dmp

Filesize
516KB

Download
memory/2752-0-0x0000000000700000-0x0000000000781000-memory.dmp

Filesize
516KB

Download
memory/2752-1-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/4400-38-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-42-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-41-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-46-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-47-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-48-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-49-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-50-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/4400-51-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download