urelas | 55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458

General

Target

55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe
Size

536KB
MD5

e3baf642db69a07e28e3aec2aec78bdd
SHA1

6a4e2ec7dce686c77f1751f7eac33a24be8fb9fe
SHA256

55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458
SHA512

f7b64d8536d15703e91b79ea64ec775191ddc7eabfb339ac33891b065a729ee0987f622a808c518ed2fffb9fa65f3df7b11b97e784e65ec7c918023ecdd8f3d2
SSDEEP

12288:cdBNKTCqqwXCcdgTw9+MvA+BisqYpxHte1oS2g:cLjQC+bs0YOg

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exexiajq.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	xiajq.exe

Executes dropped EXE 2 IoCs

Processes:

xiajq.exehuobq.exe

pid process

4684 xiajq.exe
2796 huobq.exe

pid	process
4684	xiajq.exe
2796	huobq.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4272-0-0x0000000000400000-0x000000000048B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\xiajq.exe	upx
behavioral2/memory/4272-13-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/4684-16-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/4684-26-0x0000000000400000-0x000000000048B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exexiajq.execmd.exehuobq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xiajq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huobq.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

huobq.exe

pid	process
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe
2796	huobq.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exexiajq.exe

description	pid	process	target process
PID 4272 wrote to memory of 4684	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	xiajq.exe
PID 4272 wrote to memory of 4684	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	xiajq.exe
PID 4272 wrote to memory of 4684	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	xiajq.exe
PID 4272 wrote to memory of 4196	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	cmd.exe
PID 4272 wrote to memory of 4196	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	cmd.exe
PID 4272 wrote to memory of 4196	4272	55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe	cmd.exe
PID 4684 wrote to memory of 2796	4684	xiajq.exe	huobq.exe
PID 4684 wrote to memory of 2796	4684	xiajq.exe	huobq.exe
PID 4684 wrote to memory of 2796	4684	xiajq.exe	huobq.exe

C:\Users\Admin\AppData\Local\Temp\55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe
"C:\Users\Admin\AppData\Local\Temp\55234f7a9fae7d20d400e256b63f62cdec8a3007696c54a5863af7078a90a458.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\xiajq.exe
  "C:\Users\Admin\AppData\Local\Temp\xiajq.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\huobq.exe
    "C:\Users\Admin\AppData\Local\Temp\huobq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
2b7661c6ec6638c59f7a18509f3936b4

SHA1
0279a4d9807dbf9100d521ad9b0c8f4cf208b221

SHA256
0ab1c3e8ea28e13154fa6cece24d8a3b8d3e2643f249be2738edb004da0b810f

SHA512
e646a5869cbfc5b1abd4156b2458556f54f51bdfc42567783b264b52da750787b0dab6d72a141a89511019949581d118d75a9da70baf3045b94527e05f5de963

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
75c36b40019280dbb766cd289cabfe21

SHA1
9cb5b15eba83563ea923db08118a615b78308ed9

SHA256
2430abfd003da5f84c0ce90d10c37f5e9f467d713bcc2f5ab481e2d17cd252f0

SHA512
2e237376989b9aa893d15d493965931647b2e53c82525ece8ebf2f2b84a97ad989981bfeb5dd4192cbc1a0b62c5b03a080a609d013f7e561c02ce88d83855801

Download Submit
C:\Users\Admin\AppData\Local\Temp\huobq.exe

Filesize
241KB

MD5
164fc4ccc35ff34aada5229381359637

SHA1
12ea0ec31cb5078805811dd12eaa8acc5a00f4be

SHA256
e74cd32917e8ea6b6b8f42f353646bb978d856f8db747decfdadf2e17e547046

SHA512
91332aa387e276e41d7329f22df6d6494b152a3a39208a8ad205f097aa748dc649680fefebe7062d39edc912e48565a7ddfebd173148504d44c71951455baa2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xiajq.exe

Filesize
536KB

MD5
ffd147cdc20a47327c19086b2ec85f3d

SHA1
4f5099cce3d63d1dc0fdbe462c43ac144643f043

SHA256
e7f2b9f042df6883c48b843a75481b2024170fefe19e37466542b19776a7d22e

SHA512
03785357cc0a7b7798116646bf376b97c4c6f39a7bdd116c565bbad8470194931bd992f069dd148dad29f98447072bb735cc8003d97ea13db99686b4415c512f

Download Submit
memory/2796-27-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/2796-24-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/2796-29-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/2796-30-0x00000000006E0000-0x0000000000796000-memory.dmp

Filesize
728KB

Download
memory/4272-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4272-13-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4684-16-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4684-26-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads