urelas | 635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
Size

331KB
MD5

e03c1b27b6239ebea9c12494b4f912cb
SHA1

a50459987dfa39124e5580ff86e8f25c71d512b9
SHA256

635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11
SHA512

cb720e4c0c66faed2098a2464c8518ba21fa874eda9d09bd57c9d4bfbc11382cfa2d001e53b7832b0b2b63c9f88ebcf3bb6d4312767e61f002e6381bddf460ec
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYMOFr:vHW138/iXWlK885rKlGSekcj66ciqr

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	garei.exe

Executes dropped EXE 2 IoCs

pid	Process
4044	garei.exe
4276	xucen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xucen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	garei.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe
4276	xucen.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4044	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	83
PID 1968 wrote to memory of 4044	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	83
PID 1968 wrote to memory of 4044	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	83
PID 1968 wrote to memory of 1180	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 1968 wrote to memory of 1180	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 1968 wrote to memory of 1180	1968	635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe	84
PID 4044 wrote to memory of 4276	4044	garei.exe	103
PID 4044 wrote to memory of 4276	4044	garei.exe	103
PID 4044 wrote to memory of 4276	4044	garei.exe	103

C:\Users\Admin\AppData\Local\Temp\635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe
"C:\Users\Admin\AppData\Local\Temp\635c14e9039915b579be9cb60a92844ab22752f9ee4dead4a9cc89cb496c4c11.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\garei.exe
  "C:\Users\Admin\AppData\Local\Temp\garei.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\xucen.exe
    "C:\Users\Admin\AppData\Local\Temp\xucen.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
d98649b4f98a9524d418f6db6f8a62ee

SHA1
a17919e3b7075d8838509d2a734ba07cd25a90b8

SHA256
bbb64a9ea757f086fb04bb74b2db5a2258b3059672828ff33fc2db142e5334c2

SHA512
8f7559df132bed14b9624c48b5c01c0a0a4194343902f7c472a827f149afacdd9dc2eaf75b25cb9d34a7539672cb28f19c6fec6e2ac748270f5aa8eddc396d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\garei.exe

Filesize
331KB

MD5
0ea18358a2623d687006c651f88cbc42

SHA1
87be9b279ab8f32549815547d3b578f933242fad

SHA256
d5fae645c641fa851c9accc5627646894a17e21638f7e5acf47864369a332ada

SHA512
11491b65252db56ca7c506de146ba85b95ff86260ca76788fefc44ad8b12912bfb296d8b46335545c79e743e0a33e3e36569341bc12d9aef74df5a5068dc9a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3008106b12d54ee4ba98b25bbaf8e1c0

SHA1
53ff99bd5e0e2f9acf0223322aeb7b27900d7521

SHA256
3890b2ee8730feca7046a7ded21660849abb3c4cda8c654b04c7c8dad9eb63d1

SHA512
63e3455308f4b679a10a5b9341ba7c533ecb471d271af993a00859a5c5ea513d26546fa86fc11434202e1fa1e4dda809596ad898b21b5f076310e1cd617992f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\xucen.exe

Filesize
172KB

MD5
dd2d97e974a4263546262125b16adb1b

SHA1
290843245d6718bd93eea3fb90aa876144e7c7f8

SHA256
010293442c2e9e6bc1b243ce8844094c77791d76809c2ee92664e37bb88e4503

SHA512
8081c52071cc288a3e188ad6b871b9b52e882a868fdebc723cf6cf643cb22c051b444758c310a8a7fba90b6a447a47e290aaf4b697078b98397880b210737428

Download Submit
memory/1968-1-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1968-16-0x0000000000CC0000-0x0000000000D41000-memory.dmp

Filesize
516KB

Download
memory/1968-0-0x0000000000CC0000-0x0000000000D41000-memory.dmp

Filesize
516KB

Download
memory/4044-42-0x00000000002A0000-0x0000000000321000-memory.dmp

Filesize
516KB

Download
memory/4044-15-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/4044-14-0x00000000002A0000-0x0000000000321000-memory.dmp

Filesize
516KB

Download
memory/4044-19-0x00000000002A0000-0x0000000000321000-memory.dmp

Filesize
516KB

Download
memory/4276-36-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-38-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-37-0x0000000000D90000-0x0000000000D92000-memory.dmp

Filesize
8KB

Download
memory/4276-44-0x0000000000D90000-0x0000000000D92000-memory.dmp

Filesize
8KB

Download
memory/4276-45-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-46-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-47-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-48-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download
memory/4276-49-0x00000000006D0000-0x0000000000769000-memory.dmp

Filesize
612KB

Download