urelas | ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd

General

Target

ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe
Size

543KB
MD5

cdf2e902b453c3dccc1658655f7caad3
SHA1

441bb83238e980f4d3f41f7c69d61de319be3923
SHA256

ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd
SHA512

60af098d0bb5f263889b99bbf2a1efedaec793c63a8a5794f2df96a36dcee8e337b556e63c13c24076e6f086aa3129e2bfc8cd37e4d8d890119cce7180764638
SSDEEP

12288:T52PxDgZo3ijnieactYDG7MzZSHJcvEj8dmoSxuX:92SLi70T7Mifjg

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exeewsya.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ewsya.exe

Executes dropped EXE 2 IoCs

Processes:

ewsya.exefoloz.exe

pid	Process
2728	ewsya.exe
3680	foloz.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4016-0-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/files/0x0008000000023c19-6.dat	upx
behavioral2/memory/2728-12-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/4016-14-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/2728-17-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/2728-28-0x0000000000400000-0x0000000000487000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ewsya.execmd.exefoloz.exeebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewsya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foloz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

foloz.exe

pid	Process
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe
3680	foloz.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exeewsya.exe

description	pid	Process	procid_target
PID 4016 wrote to memory of 2728	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	82
PID 4016 wrote to memory of 2728	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	82
PID 4016 wrote to memory of 2728	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	82
PID 4016 wrote to memory of 2516	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	83
PID 4016 wrote to memory of 2516	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	83
PID 4016 wrote to memory of 2516	4016	ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe	83
PID 2728 wrote to memory of 3680	2728	ewsya.exe	94
PID 2728 wrote to memory of 3680	2728	ewsya.exe	94
PID 2728 wrote to memory of 3680	2728	ewsya.exe	94

C:\Users\Admin\AppData\Local\Temp\ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe
"C:\Users\Admin\AppData\Local\Temp\ebb3346fdc9188a6d772b7bc5152b599a775b86d257a99c249d1146a22755afd.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\ewsya.exe
  "C:\Users\Admin\AppData\Local\Temp\ewsya.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\foloz.exe
    "C:\Users\Admin\AppData\Local\Temp\foloz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
f31aece61160d8cabfae378b8c7c2d11

SHA1
6daa126c4fa424c275543531892d53aeee999d7c

SHA256
e1043843a439432f794ed187edd8889ff876e752969719dfaa7f98c1a83524df

SHA512
082ade7faddca5fda620bcf92c10ad514f9aec865fd8df329dc98326fc2cdad1522d93c646ca65a58bb3b385fca4613cf1eeea11d672f811e77935d1133bf664

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewsya.exe

Filesize
543KB

MD5
1e861403adb1ac24e156e9f8dfc9122a

SHA1
525e30c28a7427aba1bcca32e487aee50b6cf693

SHA256
f94697f84a234ab47719bdc751ef780e73a0c23f7f188fa6556e38216642adf7

SHA512
949353f877e2cc6d7106d25cad393adf79f5cdc79d097758a54c2b7e385e2156ebf7c091f0134a67f90e3f64a519aa341e4d08318c416b08f92e0c45ec8b8704

Download Submit
C:\Users\Admin\AppData\Local\Temp\foloz.exe

Filesize
230KB

MD5
bdcbaa9c0d4c1e352942007bf85d582b

SHA1
365eb28f67d0c25f2fc604e30e52d5b21f7769aa

SHA256
28bc35ff395a3de9ee6232c04b383288956d5df9187f88922e08c1261ccfae5b

SHA512
154725144147c9f36e44a71ab3318ecdd528a446b28400e518a9498254affe34498b06b429580b7444ef511e2481077c856af5f5a50b64ec1d459fa1625ce051

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1b8a5296b5b0d684a29d62a9684492f2

SHA1
2bb007faaf939661094c39e8f71fbf57fefaf09c

SHA256
3036cc99ef0cd8aaf4706af321b8036bac24f248b64d807652cc0aa78685cb96

SHA512
04b89bc5d3de58382df91d8b1adc52a3655f48faf75ab26524cb8d0f36d10cd34e91a60bc2f37deaf7fa1476978decffcb123573da9ab8c5d60685156488b718

Download Submit
memory/2728-12-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2728-28-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2728-17-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3680-26-0x00000000004D0000-0x0000000000583000-memory.dmp

Filesize
716KB

Download
memory/3680-27-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3680-31-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3680-30-0x00000000004D0000-0x0000000000583000-memory.dmp

Filesize
716KB

Download
memory/3680-32-0x00000000004D0000-0x0000000000583000-memory.dmp

Filesize
716KB

Download
memory/4016-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4016-14-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads