urelas | 9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188

General

Target

9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
Size

298KB
MD5

c67a987ab822839bc87ad45a05a02c5c
SHA1

7c28f3f391e504d0ff3c181cdcc7a01e93d566b6
SHA256

9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188
SHA512

f8f4a06efa8f0d3353a6ca716a8e75cc63d7971915a6b59312b2214cdd7cdb5e1b1320dae5cf7701a065de961d111d550bcdfbdc1dd8a81ffc284e161fc65e79
SSDEEP

6144:kN43gKpDPeVvnAmZ64XMxvQ4x1OpGcm9VQl0lM/oJ4/gupXS7:Y4npK2y8zzkGHVqoq/gKU

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cazip.exe

Executes dropped EXE 2 IoCs

pid	Process
3540	cazip.exe
1948	wolit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cazip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wolit.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe
1948	wolit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
Token: SeIncBasePriorityPrivilege	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
Token: 33	3540	cazip.exe
Token: SeIncBasePriorityPrivilege	3540	cazip.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3540	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	83
PID 2268 wrote to memory of 3540	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	83
PID 2268 wrote to memory of 3540	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	83
PID 2268 wrote to memory of 2424	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	84
PID 2268 wrote to memory of 2424	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	84
PID 2268 wrote to memory of 2424	2268	9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe	84
PID 3540 wrote to memory of 1948	3540	cazip.exe	105
PID 3540 wrote to memory of 1948	3540	cazip.exe	105
PID 3540 wrote to memory of 1948	3540	cazip.exe	105

C:\Users\Admin\AppData\Local\Temp\9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe
"C:\Users\Admin\AppData\Local\Temp\9a78d87bc5cb2fbb2aeceba7681b58f6dbfd1eb1df6ecb40c073d1993b643188.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\cazip.exe
  "C:\Users\Admin\AppData\Local\Temp\cazip.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\wolit.exe
    "C:\Users\Admin\AppData\Local\Temp\wolit.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
39098ca9359155e9d3ad9ac51cc6a2aa

SHA1
9dbfc360fe7ee82f19bd2630305db83c0784392e

SHA256
37ed72b787227ade5095f592ddb503e1409cc6a194e95ec7b070ce24b10467f1

SHA512
4e38255b68f06de799a034b39c900d3d35d82778bb8b6b8311fc006820556ec610cd8546ffe2e75ccad5d5effcaa6d84009b68f919a40b4c84ac5e2c5f940e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\cazip.exe

Filesize
298KB

MD5
fef6dc994eb5674dfaf4b3268c99b75a

SHA1
ae4a440c0f6401d8d40096c42cda403ceedfbfe5

SHA256
f30e4e49eddf990f5695198aec2db1446d8bd578b7e2181e67afff22c7cd3f4e

SHA512
be835ed730718009d30d72a9281968693b54b5896d2a4fe63ce26e53a11a8256b50aaa961920e277e1ac49e6b133333f831303a0c887d32f40d8d58f35abdd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
b73a46e5c85c335a48ae84a615c64f82

SHA1
ea556393e25f2801ab7215db7a2864feb0584a99

SHA256
7104730948eb142a430e4bc40e2f1196b59d59a3a41d88871fb1ece57a9fa89e

SHA512
67ae6713ad33c62be565552ae0231df6e49477f770006070fbc5fc919ee81b37e44b85a1533e507ddef50be5d0852df0757468cc1b1d8eef11e848460a548adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\wolit.exe

Filesize
203KB

MD5
35816cbf43299abaa6cdd480a8af01b1

SHA1
af102c450bd43429d378dfd51b63e4c28f563e28

SHA256
1f36618a32bc85581976a3a81e03a6838719cd8e7992d178dd6fc4b3ec90ab35

SHA512
080783ff5d6f522c1869f51d9df4957b949cc6b4a6e2ca74cfdd9dc33d52af9d9c376de2b9bb48f35752b6991b39e3dcab6ab9cc76cacf61412049b5a5857f1b

Download Submit
memory/1948-36-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1948-39-0x0000000000492000-0x0000000000493000-memory.dmp

Filesize
4KB

Download
memory/1948-41-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1948-42-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1948-43-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2268-16-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2268-1-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2268-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3540-14-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3540-19-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/3540-38-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing