urelas | 76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bc

General

Target

76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe
Size

335KB
MD5

1994411db2a21790dc2895b8ad664790
SHA1

2c43b49f603134d83d3a2214bc8b4e2246903606
SHA256

76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bc
SHA512

f4e000122fc2be4e5a2701fde16a0ce3b3f722a26d9bbf8a70b19be81dd6f85f4c5733c6ca7ddc719c2e34c33899e5440149d36e48aff63f86ddddac78b7187f
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYwL:vHW138/iXWlK885rKlGSekcj66ciVL

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe

Executes dropped EXE 1 IoCs

Processes:

lokel.exe

pid	Process
3068	lokel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exelokel.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lokel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe

description	pid	Process	procid_target
PID 2156 wrote to memory of 3068	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	83
PID 2156 wrote to memory of 3068	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	83
PID 2156 wrote to memory of 3068	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	83
PID 2156 wrote to memory of 404	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	84
PID 2156 wrote to memory of 404	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	84
PID 2156 wrote to memory of 404	2156	76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe	84

C:\Users\Admin\AppData\Local\Temp\76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe
"C:\Users\Admin\AppData\Local\Temp\76cb6893f5462623a527d0aa8e71f2eb1f68623ae9c5ce7b28b091043e8dc3bcN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\lokel.exe
  "C:\Users\Admin\AppData\Local\Temp\lokel.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\jigyq.exe
    "C:\Users\Admin\AppData\Local\Temp\jigyq.exe"
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
f4841529eb3c6784bba677dc9e2f2f81

SHA1
cddb0f10e10355192e1c5cd04c5a5502cbecea9e

SHA256
8c88be8f914f78e8b1da1fc305af56a359eb0f212062f55659a00dc96f650da1

SHA512
cdb66869560b0115ad341e5aab15b3b48c004fadab54bbc39daa0395caf7deae599cc681aaee6bd39157c92bdcea2068dd918e4cc3a07f83d4bef37ac160982b

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f9b2d87a053f9b95f5b883051cdc7470

SHA1
8bf8696366f1b58a4a1b04679fcadfd2257a2875

SHA256
3f5b90770b46e5e64638dd9f85a32b58a5b1d88c0b725d385054b2671a2b6218

SHA512
fec71bfd2f7c1d7ca793ff0242802b43c5d76f74e8fb5054f4ac99b08c9795bfa7c6af2fdd4e6e7c21a215dd2ba051b76b22ef1602f64560d683465d7ec1d3b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jigyq.exe

Filesize
172KB

MD5
30658165178397d835e41aa03c6c94db

SHA1
0eadeb524a08b08157a27a4b6cda74d90729a86e

SHA256
d11662e66f8965b24b7c3fec9eeefb6289f4fb2055f7a5cf35ede623fca032c5

SHA512
ef9f47d0b16dce25004298ee884502891d92f1036b00f2ad5fa0fe9018325867c4759d15b3c8b5c92b821f1242b081bf9db12cfc84d88d83fd581a4cee29ea11

Download Submit
C:\Users\Admin\AppData\Local\Temp\lokel.exe

Filesize
335KB

MD5
50ce869ab6be255daeeecf0db1349efe

SHA1
9d9d117041915e7df6d0e06b57f6dd2787d059d0

SHA256
64057a195db674fe56aff0440a05c8d1e5dacdeb6182c36442589159de60e422

SHA512
af5b227e010149f935b7d7f6f01720a4a7bef85bccc782d20cf2147553ea49ed14678432f8c2f946432d835f8bd7da740fac84f8fc22249848783a95f72b81b0

Download Submit
memory/2156-1-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2156-0-0x0000000000380000-0x0000000000401000-memory.dmp

Filesize
516KB

Download
memory/2156-17-0x0000000000380000-0x0000000000401000-memory.dmp

Filesize
516KB

Download
memory/3068-20-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/3068-13-0x0000000000BA0000-0x0000000000C21000-memory.dmp

Filesize
516KB

Download
memory/3068-21-0x0000000000BA0000-0x0000000000C21000-memory.dmp

Filesize
516KB

Download
memory/3068-14-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/3068-37-0x0000000000BA0000-0x0000000000C21000-memory.dmp

Filesize
516KB

Download
memory/3232-38-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/3232-41-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/3232-40-0x0000000000C30000-0x0000000000C32000-memory.dmp

Filesize
8KB

Download
memory/3232-45-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download
memory/3232-46-0x0000000000C30000-0x0000000000C32000-memory.dmp

Filesize
8KB

Download
memory/3232-47-0x00000000005D0000-0x0000000000669000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads