urelas | a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528

General

Target

a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe
Size

442KB
MD5

0e97fb91d36776868935265a493c0020
SHA1

f30211f2bcf09fc58dd129f454b38c2fc54e7618
SHA256

a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528
SHA512

16f21fabc16f2026793163b07232280f47d620661cbe50661568eff65aa54131b172645e7bcfb4cb0bf731b24a831c74f1b34c9f2dacf7e57773c6565f2ac275
SSDEEP

6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGM5:rKf1PyKa2H3hOHOHz9JQ6zBA

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.165

218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2556 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

ficup.exebyfue.exe

pid process

2672 ficup.exe
2620 byfue.exe
Loads dropped DLL 2 IoCs

Processes:

a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exeficup.exe

pid process

2756 a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe
2672 ficup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2556	cmd.exe

pid	process
2672	ficup.exe
2620	byfue.exe

pid	process
2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe
2672	ficup.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

byfue.exea347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exeficup.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byfue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ficup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

byfue.exe

pid	process
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe
2620	byfue.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exeficup.exe

description	pid	process	target process
PID 2756 wrote to memory of 2672	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	ficup.exe
PID 2756 wrote to memory of 2672	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	ficup.exe
PID 2756 wrote to memory of 2672	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	ficup.exe
PID 2756 wrote to memory of 2672	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	ficup.exe
PID 2756 wrote to memory of 2556	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	cmd.exe
PID 2756 wrote to memory of 2556	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	cmd.exe
PID 2756 wrote to memory of 2556	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	cmd.exe
PID 2756 wrote to memory of 2556	2756	a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe	cmd.exe
PID 2672 wrote to memory of 2620	2672	ficup.exe	byfue.exe
PID 2672 wrote to memory of 2620	2672	ficup.exe	byfue.exe
PID 2672 wrote to memory of 2620	2672	ficup.exe	byfue.exe
PID 2672 wrote to memory of 2620	2672	ficup.exe	byfue.exe

C:\Users\Admin\AppData\Local\Temp\a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe
"C:\Users\Admin\AppData\Local\Temp\a347bd0f8f685bde5f365596366d5b2eab7b0548e7eb67721a7cb74228cbe528.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\ficup.exe
  "C:\Users\Admin\AppData\Local\Temp\ficup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\byfue.exe
    "C:\Users\Admin\AppData\Local\Temp\byfue.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
3a634cc49790e2bc9da2bb9f70159dc2

SHA1
251cd153f8976c0b814612a394a0c5a10d1dff3c

SHA256
52146206755f0b2026399fd33daa8bbb9a41a6d33aa254383c45768dccad637a

SHA512
04d1e50cbf6391023bde91645d657a564e531c8db14051189019874da56fbb647704b95265ee57984800a4099727625549e26b406735b875153232439a2b6392

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
b8d01b3c938af30e62ab771bca8ed349

SHA1
4707f2289d122703bb90bf78b69c644a4c42c073

SHA256
1c445bbdcbdb396c834ea778fd33310ca61af8fb26026721d208d1847e07fe8c

SHA512
21e9b30a7673e6aa700840e2c8dcc40ab5c97f276ece9c0bf8c640b1c8e2749315f172bb11821a6f76684900406c983f5006235090ce2587468cf66b2cc9e02b

Download Submit
\Users\Admin\AppData\Local\Temp\byfue.exe

Filesize
230KB

MD5
5bd20465e9b2d64ae41f4b555affb06b

SHA1
a94e06fc2dede2edd4050de6fce2a54d29661c03

SHA256
feb7ca818948ac19f09e610bc2ec035664f97b9fe0d2bfe284fe7aa178be3237

SHA512
7cc22565973a5170b34f37994abd51f943c920dea815191a1233a551cb9aa5d19d86616f3cc2972a0b5756647a7734c5451d8ba95779238760da0495900f67e3

Download Submit
\Users\Admin\AppData\Local\Temp\ficup.exe

Filesize
442KB

MD5
4acd0dcf92262334466bb8817d02c540

SHA1
746fe1161fe8478d16003ce368c385a88fb3b064

SHA256
d4579b194f427aaadd5e3f497531828ab99ad814831be32996097dea22855506

SHA512
6223918237eee9e0e25b7d71c98057f41bfb394b47eff630db824ff27835583257ae54c95bd36d2f0a90abae943e0e07f977cc401e0a09f9d19948608942de26

Download Submit
memory/2620-33-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2620-38-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2620-37-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2620-36-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2620-35-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2620-31-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2620-30-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2620-34-0x0000000000E60000-0x0000000000EFE000-memory.dmp

Filesize
632KB

Download
memory/2672-21-0x0000000000EA0000-0x0000000000F0E000-memory.dmp

Filesize
440KB

Download
memory/2672-27-0x0000000003000000-0x000000000309E000-memory.dmp

Filesize
632KB

Download
memory/2672-29-0x0000000000EA0000-0x0000000000F0E000-memory.dmp

Filesize
440KB

Download
memory/2672-18-0x0000000000EA0000-0x0000000000F0E000-memory.dmp

Filesize
440KB

Download
memory/2756-0-0x00000000010C0000-0x000000000112E000-memory.dmp

Filesize
440KB

Download
memory/2756-9-0x0000000002530000-0x000000000259E000-memory.dmp

Filesize
440KB

Download
memory/2756-17-0x00000000010C0000-0x000000000112E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads