urelas | 635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
Size

331KB
MD5

e03c1b27b6239ebea9c12494b4f912cb
SHA1

a50459987dfa39124e5580ff86e8f25c71d512b9
SHA256

635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11
SHA512

cb720e4c0c66faed2098a2464c8518ba21fa874eda9d09bd57c9d4bfbc11382cfa2d001e53b7832b0b2b63c9f88ebcf3bb6d4312767e61f002e6381bddf460ec
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOFr:vHW138/iXWlK885rKlGSekcj66ciqr

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

koidw.exe635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	koidw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe

Executes dropped EXE 2 IoCs

Processes:

koidw.exebiurr.exe

pid	Process
4472	koidw.exe
512	biurr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

biurr.exe635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exekoidw.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biurr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	koidw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

biurr.exe

pid	Process
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe
512	biurr.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exekoidw.exe

description	pid	Process	procid_target
PID 548 wrote to memory of 4472	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 548 wrote to memory of 4472	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 548 wrote to memory of 4472	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 548 wrote to memory of 5056	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	85
PID 548 wrote to memory of 5056	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	85
PID 548 wrote to memory of 5056	548	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	85
PID 4472 wrote to memory of 512	4472	koidw.exe	94
PID 4472 wrote to memory of 512	4472	koidw.exe	94
PID 4472 wrote to memory of 512	4472	koidw.exe	94

C:\Users\Admin\AppData\Local\Temp\635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
"C:\Users\Admin\AppData\Local\Temp\635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\koidw.exe
  "C:\Users\Admin\AppData\Local\Temp\koidw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\biurr.exe
    "C:\Users\Admin\AppData\Local\Temp\biurr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
d98649b4f98a9524d418f6db6f8a62ee

SHA1
a17919e3b7075d8838509d2a734ba07cd25a90b8

SHA256
bbb64a9ea757f086fb04bb74b2db5a2258b3059672828ff33fc2db142e5334c2

SHA512
8f7559df132bed14b9624c48b5c01c0a0a4194343902f7c472a827f149afacdd9dc2eaf75b25cb9d34a7539672cb28f19c6fec6e2ac748270f5aa8eddc396d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\biurr.exe

Filesize
172KB

MD5
59fb23441574dd50fec42c5b6671ced5

SHA1
fc7f8e81b161aca6c6832ff401327a46460fd535

SHA256
a62182b9b463036a8e1819bad2d96bdc766006f7ae1fdffca5f2c788f73a524b

SHA512
d53fdb8073dc172c9533d3a70c94d8dab3c8127bfbc017328b8c87a0d026a3a457d07430b0e6f3a5576fad4dae56ef180418ee10076ec5e4a659849e735491f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f07baf4a3752405f8d7ddae62aec0c94

SHA1
8da4df9831888431cb5bca8d23d033a15d7b914b

SHA256
3bdd3f8a100e4d4ca353ca67b2a188246f19f5c381797478c3793acf21e0f5bc

SHA512
c81d071dcd71bced8c5580cc5de9e858150878ace2f0ae6987fc883bec7aadc2f2716982bb8ec18d4151cf30d50fdee6f3650427341d7144f7920cc707e08674

Download Submit
C:\Users\Admin\AppData\Local\Temp\koidw.exe

Filesize
331KB

MD5
23003c757db168f46bccf128e5b9b716

SHA1
482b842488a6f29e6452707b547d184440860cc6

SHA256
824504b69662a18f0162ab03b2a302d9362d8ec7b6d833e41cfbe113946f5394

SHA512
4d2a1617f246d2630f07d40ab39ac4b77a9cb9c443a0af357b8a59ffe39635444c4f147dcfb2862b55302a7133a0d7590137ce9eb42f06a9295861488722143d

Download Submit
memory/512-46-0x0000000000340000-0x0000000000342000-memory.dmp

Filesize
8KB

Download
memory/512-47-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-50-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-49-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-40-0x0000000000340000-0x0000000000342000-memory.dmp

Filesize
8KB

Download
memory/512-48-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-41-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-36-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/512-45-0x0000000000C80000-0x0000000000D19000-memory.dmp

Filesize
612KB

Download
memory/548-17-0x00000000001D0000-0x0000000000251000-memory.dmp

Filesize
516KB

Download
memory/548-1-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/548-0-0x00000000001D0000-0x0000000000251000-memory.dmp

Filesize
516KB

Download
memory/4472-20-0x0000000000D50000-0x0000000000DD1000-memory.dmp

Filesize
516KB

Download
memory/4472-39-0x0000000000D50000-0x0000000000DD1000-memory.dmp

Filesize
516KB

Download
memory/4472-14-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4472-11-0x0000000000D50000-0x0000000000DD1000-memory.dmp

Filesize
516KB

Download