urelas | 9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3

General

Target

9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe
Size

510KB
MD5

b639bc0a212aee9bc09ae316daff5210
SHA1

240e3ec4bc4255de9a585442aebf034a6df69c4c
SHA256

9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3
SHA512

36f549f9e1a4deb187cbd7e2bab8c16cb31078e2d5a503f8949abf077f4389ce96198d3fbdead95632e5c284c6269625fb2bba87bcaf96f6c1641ff61485ad07
SSDEEP

12288:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKou:3MUv2LAv9AQ1p4dKb

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	coego.exe

Executes dropped EXE 2 IoCs

pid	Process
4204	coego.exe
4900	duxeh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coego.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duxeh.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe
4900	duxeh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4204	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	83
PID 3132 wrote to memory of 4204	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	83
PID 3132 wrote to memory of 4204	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	83
PID 3132 wrote to memory of 1528	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	84
PID 3132 wrote to memory of 1528	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	84
PID 3132 wrote to memory of 1528	3132	9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe	84
PID 4204 wrote to memory of 4900	4204	coego.exe	104
PID 4204 wrote to memory of 4900	4204	coego.exe	104
PID 4204 wrote to memory of 4900	4204	coego.exe	104

C:\Users\Admin\AppData\Local\Temp\9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe
"C:\Users\Admin\AppData\Local\Temp\9b4b13dbca371f99fe0defc8d6c2370d7513d923061385636b2f344d0e6e07d3N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\coego.exe
  "C:\Users\Admin\AppData\Local\Temp\coego.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Users\Admin\AppData\Local\Temp\duxeh.exe
    "C:\Users\Admin\AppData\Local\Temp\duxeh.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
d35772d3dd604dfd49eb86ebaa6f5f1a

SHA1
db915609f0889d7aba69169fb5aa71a9c3bda4b5

SHA256
f64da20470ab784b9e6e9e5056337861abf5972830b06d518d9d8dc2befe508d

SHA512
8c3c6386823a5479fbde39361856153dd2e4baadfc87e95174fdf6d78cf742da7d41521ffcbd736b91ef3046602128900f528dc3bcc86007b6dd6d3ce90aa871

Download Submit
C:\Users\Admin\AppData\Local\Temp\coego.exe

Filesize
510KB

MD5
e8622865e28a0ac91bc44aff1c46a5af

SHA1
0f22e0509ea840b8f44dc21fc824f79ce3005843

SHA256
dd63db3c6363785b904658990c5677d74c12b95c9ddc1151d3d87a8d368c1f8b

SHA512
2d0987ec11caf9da1c75ea6bd336c4de04d2d18d0ec5cd759acf66fc0cf1a6f0015405f38c9f2b8cd462496e07e24f4854add25172a4e7124592477f712fe5d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\duxeh.exe

Filesize
172KB

MD5
56d463198b3eb0b623932ac6a2805b93

SHA1
fb3abde26747d29bd5c1fde75fa23e39e621a41c

SHA256
a597d6c0dc7007264a0eb1e8c937e83e43011e0b5cf34f15acd513dca2e2325c

SHA512
eafef41db72bcb7afd1e60c346701383b61c59c72b81d1aca572bc58ed0d1e6ea1d308879cadda5d08b4ed9663eefcd42b61687ec147b0ab12909e87b6cd2c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a24e3008957da68734e391ab08b8baf0

SHA1
ff79f4e384e9cbcfb4029723b3269ad803b7e3fe

SHA256
323d8c905b3a3675a69f4ef3fec0f1ec052205a82770cdea59b6639510526984

SHA512
0808033542a30a73abd6a0614db26225746aa6725f603f9ffeff3ce0617be9fe868ac699c32c6467f407a7d3fdb3d742981ebcd747b4368256af4f29cbb7b995

Download Submit
memory/3132-0-0x0000000000510000-0x0000000000591000-memory.dmp

Filesize
516KB

Download
memory/3132-14-0x0000000000510000-0x0000000000591000-memory.dmp

Filesize
516KB

Download
memory/4204-17-0x0000000000750000-0x00000000007D1000-memory.dmp

Filesize
516KB

Download
memory/4204-10-0x0000000000750000-0x00000000007D1000-memory.dmp

Filesize
516KB

Download
memory/4204-27-0x0000000000750000-0x00000000007D1000-memory.dmp

Filesize
516KB

Download
memory/4900-25-0x0000000000F80000-0x0000000001019000-memory.dmp

Filesize
612KB

Download
memory/4900-28-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/4900-29-0x0000000000F80000-0x0000000001019000-memory.dmp

Filesize
612KB

Download
memory/4900-34-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/4900-33-0x0000000000F80000-0x0000000001019000-memory.dmp

Filesize
612KB

Download
memory/4900-35-0x0000000000F80000-0x0000000001019000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing