urelas | 3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124

General

Target

3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe
Size

537KB
MD5

b20e55b1dcce2bfa5356a84bcd9da7d9
SHA1

79e4dffeb55d8c3818ad3b8ce3c1048f9baf92ee
SHA256

3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124
SHA512

dc7ac12b0c4df4d4d0d31875fce8c4e2fec5ede05cf8ffa26a2bae6e8983ccde39550535c8d9f06b0130994de5ebe96fc66a0a5d71075c2318aab92e3eb29480
SSDEEP

12288:q0nPhglq2Uyt4R/b2G/0hznQGoexBU/NPg:q0P/k4lb2wKatg

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exefucyk.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fucyk.exe

Executes dropped EXE 2 IoCs

Processes:

fucyk.exekituq.exe

pid process

4468 fucyk.exe
3904 kituq.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4468	fucyk.exe
3904	kituq.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exefucyk.execmd.exekituq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fucyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kituq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

kituq.exe

pid	process
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe
3904	kituq.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exefucyk.exe

description	pid	process	target process
PID 2260 wrote to memory of 4468	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	fucyk.exe
PID 2260 wrote to memory of 4468	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	fucyk.exe
PID 2260 wrote to memory of 4468	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	fucyk.exe
PID 2260 wrote to memory of 2832	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	cmd.exe
PID 2260 wrote to memory of 2832	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	cmd.exe
PID 2260 wrote to memory of 2832	2260	3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe	cmd.exe
PID 4468 wrote to memory of 3904	4468	fucyk.exe	kituq.exe
PID 4468 wrote to memory of 3904	4468	fucyk.exe	kituq.exe
PID 4468 wrote to memory of 3904	4468	fucyk.exe	kituq.exe

C:\Users\Admin\AppData\Local\Temp\3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe
"C:\Users\Admin\AppData\Local\Temp\3c1195d085a9ac66a0f1ddaa1e832855c5a45f5db35ea1953d6bd3b48dc46124.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\fucyk.exe
  "C:\Users\Admin\AppData\Local\Temp\fucyk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Users\Admin\AppData\Local\Temp\kituq.exe
    "C:\Users\Admin\AppData\Local\Temp\kituq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
50246892b31984ab4015a5076fcaca9a

SHA1
882bda725f7c0a959de66d3ba722344dc5aa2814

SHA256
2c8d08bfb822716eb5c40d51356621af10b57d043c97a87a93b06f27ef047651

SHA512
1697fcc1bd015d7bdbbde0230248ecd465f16acf8ea7143465f6ea326b558e1797a7e28132f374f58b360757fca57659e7f4481c926b199f712c6579442533a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fucyk.exe

Filesize
537KB

MD5
7d4c7dd1aac4a375b6d8399c7c383c6d

SHA1
4af0e70e3549258e9f2d4015fc62b9ac70d3e04c

SHA256
427421e03375a4415ebf228b8fedf42bcaef559ca20f08f3507c5ff19c0d8bdb

SHA512
8919d5d74bf3fd075818e3a4b49cb6a9427812d63437bca81eefb9d8cc2f859d8beb8d74e4289f08ae876e46e68741b46b478b655abd380ba9acd8a9db0d3728

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
74817422759f07d89ee63c17d0dbf62b

SHA1
2f4019636c2036b9bb7e9e405b8b09a3d53c5a4a

SHA256
a563877470007030639ef445a5f5d70433f29eab7b756aecfe5bcf40f38d3ee6

SHA512
7280e07477e90c797b06cd60b2529a12c1ebac6002c9b3811c84e8c2039e56322c3bcfd99874964a631a9fa2d1d8a81b68efbed7ce8784f132950be5db41eeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\kituq.exe

Filesize
236KB

MD5
198e6ebac33741dcbcf7ae9657a08215

SHA1
f90d8239dd8ac920c3471bf875fdf12a38b801fd

SHA256
025523c09b69ed082d91ee8fb15a0c4896bc7c23f6c71d7f0a25dbf23136cd7d

SHA512
c3209b436ef2f0e5ca797e3d98ee5920c69ab9499c5aa13a8765b08d61cfd9dda2db7f10b6ff7d642ab3e186e2b1bd840328c1fddc39d8f0c4c0c9843ded2b8e

Download Submit
memory/2260-13-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2260-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3904-25-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/3904-27-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/3904-29-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/3904-30-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/3904-31-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/3904-32-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/3904-33-0x0000000000BB0000-0x0000000000C53000-memory.dmp

Filesize
652KB

Download
memory/4468-16-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4468-26-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads