urelas | e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe
Size

533KB
MD5

d0b820b8854a6713fa4ca98a72441157
SHA1

afd9ecb1355f66c507294bc3f7667e61dc902f69
SHA256

e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113
SHA512

6712db2173af63d253b06af6ab58c193683ed970eb4c4ecb3cad4c9d8d69eb6591bc6c77ed8295957e5a7e15d4fa8f6a5e49c4779eb52b50038142be5e1f2d26
SSDEEP

12288:q0nPhglq2Uyt4R/b2G/0hznQGoexBU/NP8:q0P/k4lb2wKat8

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	uzbeo.exe

Executes dropped EXE 2 IoCs

pid	Process
3276	uzbeo.exe
1420	rizel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rizel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzbeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe
1420	rizel.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3276	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	84
PID 3036 wrote to memory of 3276	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	84
PID 3036 wrote to memory of 3276	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	84
PID 3036 wrote to memory of 4244	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	85
PID 3036 wrote to memory of 4244	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	85
PID 3036 wrote to memory of 4244	3036	e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe	85
PID 3276 wrote to memory of 1420	3276	uzbeo.exe	94
PID 3276 wrote to memory of 1420	3276	uzbeo.exe	94
PID 3276 wrote to memory of 1420	3276	uzbeo.exe	94

C:\Users\Admin\AppData\Local\Temp\e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe
"C:\Users\Admin\AppData\Local\Temp\e1e5ef106a6675f9d5bab4ed3f29e5edd55e65ffc9b2fefd7aa9ea4590c19113.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\uzbeo.exe
  "C:\Users\Admin\AppData\Local\Temp\uzbeo.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\rizel.exe
    "C:\Users\Admin\AppData\Local\Temp\rizel.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
7b52d06d75d584f893caa0360974f8bf

SHA1
d5a239225dfd50d20337283adcd31ae8ccf860c8

SHA256
43b69aee365c7c59018d2457e278dddaa48cabd8a32bb4f87ef707fa5addc371

SHA512
be019af072302252e89f38cc9457e7b36f792297b834d375be0ca595ae3a715fe2fa1f68fe0654c23e1288eb1c483b74defa680ab69c0e360083ae4b54429e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d773b19d04066b4884ebcb9a4a665f43

SHA1
c5fe6254063be4dc805d6bd0efd495b0cebf00b1

SHA256
c7d9ad9be26b96a8ecde9b7d504588b7c30a55570d86eeb364e24c627daac512

SHA512
d40083b6b9ccace47d15c98ad451c07c542a7d896bd0e8d0670e9a93a05c30a451d458477de60ff2a0c6504b34a376b3772772a4ff28a05dee6d62831d634918

Download Submit
C:\Users\Admin\AppData\Local\Temp\rizel.exe

Filesize
236KB

MD5
4ae08922d96071fd05aee7c16396672f

SHA1
e98266e2555c2aef53e7fcda5c5ca368eea2872b

SHA256
faf7ca6f9038456d7f0042f31e5685aad13582accbe4f95f7607c605a745e7b5

SHA512
06230b2841e8d9b2747bf950be5eeb08dbb718e353ac44afa055c22bb3d1fdeeee8d41bc00128a1e8caf5a3bb629def94002a62a7cb4a3693e3b0244f9206817

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzbeo.exe

Filesize
533KB

MD5
df8a0c6248c680d4ccb284f144128c03

SHA1
0d5d70925339cd3f9c571ad85f20dec642a86f02

SHA256
6da3580b168995d4ef951242f3eedef8064d85dcdc1fb92af874699d55646025

SHA512
6318f81013989c17770773a5675239ba524fb3b914ce9e538949e11844f6a2d8030dd5b220f7ead664104b19f265d5f6fb4842956205849ae237c66dad541dd8

Download Submit
memory/1420-26-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/1420-28-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1420-30-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/1420-31-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/1420-32-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/1420-33-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/1420-34-0x00000000006E0000-0x0000000000783000-memory.dmp

Filesize
652KB

Download
memory/3036-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3036-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3276-17-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3276-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3276-27-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download