urelas | 9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942

General

Target

9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe
Size

330KB
MD5

4b9902bf074634779cdbe5af3775a6c6
SHA1

d52eb67aa4a794b1db570a367cf0992a8e8e1d76
SHA256

9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942
SHA512

f6777d9b59c5194a91de39ab382718b70f0399bc0bbf0d708629986e0e2710d667073ac6619c67f6afdd7f9daa0ecf5f998634a26e3c8124aec653d8f8aee221
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOF+:vHW138/iXWlK885rKlGSekcj66ciq+

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1264	evuwx.exe
1896	bydor.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe
1264	evuwx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evuwx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bydor.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe
1896	bydor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1264	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	30
PID 1704 wrote to memory of 1264	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	30
PID 1704 wrote to memory of 1264	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	30
PID 1704 wrote to memory of 1264	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	30
PID 1704 wrote to memory of 2792	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	31
PID 1704 wrote to memory of 2792	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	31
PID 1704 wrote to memory of 2792	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	31
PID 1704 wrote to memory of 2792	1704	9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe	31
PID 1264 wrote to memory of 1896	1264	evuwx.exe	34
PID 1264 wrote to memory of 1896	1264	evuwx.exe	34
PID 1264 wrote to memory of 1896	1264	evuwx.exe	34
PID 1264 wrote to memory of 1896	1264	evuwx.exe	34

C:\Users\Admin\AppData\Local\Temp\9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe
"C:\Users\Admin\AppData\Local\Temp\9b78d19afe8ef274b9debee712a7fbf1f8ca2d0a4f9c1d2005f0542d792fb942.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\evuwx.exe
  "C:\Users\Admin\AppData\Local\Temp\evuwx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\bydor.exe
    "C:\Users\Admin\AppData\Local\Temp\bydor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
8b64ad45b5e7598b2e4092a12902d5ef

SHA1
d16afd55a7e635525beeed1b5592d41ba773c39a

SHA256
c309c48c998642b0f0faa3efc8878dbbbe769ee779ddfcf9cce6f0251d03e3c2

SHA512
c7b1ee3b5238fc1ba90c65c67765ac80109c6edc78d032933b587c855854c6332b4f83ee7cc5c911a4ccf7bdb13e6efc712304fd4eee05004328148f91a9d4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\evuwx.exe

Filesize
330KB

MD5
087048930a119503168f3609073cafd8

SHA1
cac804491fb38e0a5d38472e5ae6dc6e4ae12424

SHA256
3e741e6ae4eb56c5f2f02a4571e050230e69c862cb02ba50bdc61974233efa1a

SHA512
961343e3092de40d1bce199e53f43a3547408cd21f0510617981f96bae3c9ca92b54bb816f3eace530505d68d31eb1fe73a45b45bef9421fc007ec134ae7a388

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
28347e6154a1ab0c1c8da8f1c2258454

SHA1
73c817e21646897e7793fd4f61772683a01d1fef

SHA256
aa0e784f9400c108301554f97695c12f397b73e9f629622ef0ee13e75fee4b3e

SHA512
35fc36bcf98721cc8f871ddc7860440b6939358f4ccd482eaa666dda5b6ada0c6b296c0e592e2a98c3a727daac7bef4f84b3808ba4a019c09095f586fad9f473

Download Submit
\Users\Admin\AppData\Local\Temp\bydor.exe

Filesize
172KB

MD5
fe5ed47d1e2df7f6e7740ee9b4d8624f

SHA1
96f7e6e46bd922422dfaa7d514502820ba24745e

SHA256
05e6c61ecbb78d74b44576de0c57a44ac78469b832aad9dccd69f8f0800af719

SHA512
4fd35eabfb1b9daed73f90e4d46d2cca192fba95ee2baeed0c7ef14a34b9b6df44434de6808a031cd117c21ec0463c15d66e06d37739cffdcc4e4a4e9ef150d4

Download Submit
\Users\Admin\AppData\Local\Temp\evuwx.exe

Filesize
330KB

MD5
75fcd4b4b6eac86aa3a4e9f4d2a93074

SHA1
fef59a02d7f8be425b489a99faab6c4e745d88db

SHA256
6d0d40d52fa3a102fea4d08173a623c689985b16ee90c15924ffe16dcc469d82

SHA512
0d1a722f02f0d284896c497ccc408a8bae921fa5e81eba1054f2abefdf580ec74b1fcadf1816aab9c449d20ed10d836fc9b5ea048fe85e0b4d9d3126e3c3a9c2

Download Submit
memory/1264-20-0x00000000010D0000-0x0000000001151000-memory.dmp

Filesize
516KB

Download
memory/1264-38-0x0000000001000000-0x0000000001099000-memory.dmp

Filesize
612KB

Download
memory/1264-42-0x00000000010D0000-0x0000000001151000-memory.dmp

Filesize
516KB

Download
memory/1264-21-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1264-24-0x00000000010D0000-0x0000000001151000-memory.dmp

Filesize
516KB

Download
memory/1704-32-0x00000000024E0000-0x0000000002561000-memory.dmp

Filesize
516KB

Download
memory/1704-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1704-18-0x0000000000F50000-0x0000000000FD1000-memory.dmp

Filesize
516KB

Download
memory/1704-19-0x00000000024E0000-0x0000000002561000-memory.dmp

Filesize
516KB

Download
memory/1704-0-0x0000000000F50000-0x0000000000FD1000-memory.dmp

Filesize
516KB

Download
memory/1896-46-0x0000000000FC0000-0x0000000001059000-memory.dmp

Filesize
612KB

Download
memory/1896-43-0x0000000000FC0000-0x0000000001059000-memory.dmp

Filesize
612KB

Download
memory/1896-49-0x0000000000FC0000-0x0000000001059000-memory.dmp

Filesize
612KB

Download
memory/1896-50-0x0000000000FC0000-0x0000000001059000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing