urelas | 4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1

General

Target

4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe
Size

335KB
MD5

656c52672acd38b367c7e81c9523160e
SHA1

aeec37f8fb38a07b7e9cb06fd99d7b0f0ca40863
SHA256

4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1
SHA512

bd07a8019ef70e6a8e05f495abb04341cf5f887e7148d1e8ad0128671684e157f0850e0edcde1ef24a98234c2d19f884a1aefa2bfa73010c528a5d11ef2d7d2f
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYy:vHW138/iXWlK885rKlGSekcj66ciD

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	qynuc.exe

Executes dropped EXE 2 IoCs

pid	Process
1124	qynuc.exe
3280	gebiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qynuc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebiv.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe
3280	gebiv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1124	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	82
PID 4796 wrote to memory of 1124	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	82
PID 4796 wrote to memory of 1124	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	82
PID 4796 wrote to memory of 3120	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	83
PID 4796 wrote to memory of 3120	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	83
PID 4796 wrote to memory of 3120	4796	4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe	83
PID 1124 wrote to memory of 3280	1124	qynuc.exe	94
PID 1124 wrote to memory of 3280	1124	qynuc.exe	94
PID 1124 wrote to memory of 3280	1124	qynuc.exe	94

C:\Users\Admin\AppData\Local\Temp\4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe
"C:\Users\Admin\AppData\Local\Temp\4cf7b941b444e78dc4bf2ec2e8fc9fdf7e165a80a718be8d4bad1510dafe4bf1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\qynuc.exe
  "C:\Users\Admin\AppData\Local\Temp\qynuc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\gebiv.exe
    "C:\Users\Admin\AppData\Local\Temp\gebiv.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
e3aef9da755fc2c331152df0a7f489da

SHA1
98b36755e9ef9e55ab9fa332777aaa4de09b487f

SHA256
ed4248cfb3200367bb9da58dda79fe97861dae2a6548acf1b5a921719c9fc005

SHA512
f228d6eb815b07c67452d7575118e1b2f105dc74fd4ec3523fd1be5660c2356d36abc5002612fa671901156d39c832d3c0f5b109c8f6636e8d6ad59113d06ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\gebiv.exe

Filesize
172KB

MD5
b9d9fab9a0bbb811e26a2d387bc2aae9

SHA1
9d3de320d7e4f4a43a4a35d9efe73a1ef53b715b

SHA256
a8d9e9c5ce3e79e6fdae3ce4b488c3aec70a2eb6c688270d04adcb99eb198f24

SHA512
f9c0170bd95873f7acf79d529f4d7746e9d89e6e6c30493ae1aa2008e9edbaf6a3c6cb111ee1313c7e84c2b3be0c0b59dfe4a93cac2fec87f4a90e2b54ca474f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
0d5973a432da91022ab30994f78b0b23

SHA1
0b3443ddea01a53bf80c3c009cc816de7ae414c7

SHA256
4cba05143e03765afcf10825853591f518a991685c2877358b55c3027a299a0a

SHA512
f3ffd136c46db13fd11d3162d6dc86f4d61d38bc84b978f78091bd9c25cbcd23e49a56fb9ef89bad6010cb6ce4d6635304c9bd4995436f175da0490b48ae023d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qynuc.exe

Filesize
335KB

MD5
c70317d6a8dcbedf7ce5070e51f67f45

SHA1
440c93c041a1c77b62d32f23854a6405886e0f92

SHA256
84c65e2a656a893ffc3494f089fd25a60edf8602f636d27e59c4f3fa6c8c4619

SHA512
c450fb7f24eced65508bca6f61024381735c50c437675a5f03fb96e51784153b899bf36fecfeb7bfbc0284af72128b38cc653b7462eb105bf826d6b711ef2792

Download Submit
memory/1124-20-0x00000000008D0000-0x0000000000951000-memory.dmp

Filesize
516KB

Download
memory/1124-11-0x00000000008D0000-0x0000000000951000-memory.dmp

Filesize
516KB

Download
memory/1124-14-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1124-21-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/1124-43-0x00000000008D0000-0x0000000000951000-memory.dmp

Filesize
516KB

Download
memory/3280-37-0x00000000008A0000-0x0000000000939000-memory.dmp

Filesize
612KB

Download
memory/3280-44-0x0000000000D00000-0x0000000000D02000-memory.dmp

Filesize
8KB

Download
memory/3280-40-0x00000000008A0000-0x0000000000939000-memory.dmp

Filesize
612KB

Download
memory/3280-46-0x00000000008A0000-0x0000000000939000-memory.dmp

Filesize
612KB

Download
memory/3280-47-0x00000000008A0000-0x0000000000939000-memory.dmp

Filesize
612KB

Download
memory/4796-17-0x0000000000490000-0x0000000000511000-memory.dmp

Filesize
516KB

Download
memory/4796-0-0x0000000000490000-0x0000000000511000-memory.dmp

Filesize
516KB

Download
memory/4796-1-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing