urelas | 40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c

General

Target

40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe
Size

337KB
MD5

53ac000b628536d3b532efbd2d8846b4
SHA1

091906986ad4bad87d885985e9b94b8df39dbf1e
SHA256

40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c
SHA512

56f18871a2d08423b1ab48f062327633c04a0bb20489adc38efda0cfe2d10d551b5fb127968534eb17d3e02c51b155afa7a77108832b3a54ad2da3b6b56cd281
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYl:vHW138/iXWlK885rKlGSekcj66ciU

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	vaorh.exe

Executes dropped EXE 2 IoCs

pid	Process
2708	vaorh.exe
3632	riery.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vaorh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	riery.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe
3632	riery.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2708	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	83
PID 4260 wrote to memory of 2708	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	83
PID 4260 wrote to memory of 2708	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	83
PID 4260 wrote to memory of 2752	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	84
PID 4260 wrote to memory of 2752	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	84
PID 4260 wrote to memory of 2752	4260	40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe	84
PID 2708 wrote to memory of 3632	2708	vaorh.exe	104
PID 2708 wrote to memory of 3632	2708	vaorh.exe	104
PID 2708 wrote to memory of 3632	2708	vaorh.exe	104

C:\Users\Admin\AppData\Local\Temp\40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe
"C:\Users\Admin\AppData\Local\Temp\40044b6a74c6878ea917eb7fb60f90a6c0d712e89a44b5597070b428e2c1620c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\vaorh.exe
  "C:\Users\Admin\AppData\Local\Temp\vaorh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\riery.exe
    "C:\Users\Admin\AppData\Local\Temp\riery.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
6159adc1cb3082c6fba29dfa4259cbff

SHA1
5433d9d06057c56c48705e845b2752d83e010512

SHA256
5797579a6cf20ab1438fa6b8b6c63962815956eb46f0187a63e53254a9d92649

SHA512
8784d5bca01318502b0044e38acb2b6352055b620f407127e7d27c897d11513fc74bf6a423b1d4c86fdbae7dd905ba0d7821c7660df1f7de21c9b87f14c2705e

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
87760657de8502a33c7c542e8e4150f3

SHA1
b9ec177e94a3f11125feed1d692c4a8b0e00230c

SHA256
4fbfe7c52376dbe69670766629fdab66230b1f5fec1a7ec3bfbd84afec4ae0e9

SHA512
fc1d15be171a3acd5e630ea38510390751eff11db22f498d3ebbebbdf890ba8fd6b1ad771a064cbfa143089641d3357077b4ca74c3fd7237dfcec7922694386d

Download Submit
C:\Users\Admin\AppData\Local\Temp\riery.exe

Filesize
172KB

MD5
03d93addc44b367d1219a5b767dd5a34

SHA1
5c9479180e9195d66106fff48b0c63626c0e9f81

SHA256
0d45a11aca5a4a42567874fe6ea1096d3aba0d9e5776e2ea15fe0ea20f37e471

SHA512
f8fb8f30b240095f1952a461d49abdfeba0d81c4a00d5cf3afc9c840b2ca412e6b42c931c852d4272f6eeff6a994dcd6a108b742d72ddc050012f63e6166a56a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vaorh.exe

Filesize
337KB

MD5
479d1b1502b8402a99503a7b87302508

SHA1
e855db8dada35033d316b2e90f5943e04ff5e128

SHA256
936b31f26324a4b4395e559f431e233e54b3406ac95071da56ce0f2d7e95ae72

SHA512
3f697d8cf334132449d879498f0accbf99b78b146d219a5995379cf00ed152290c235cbe90f9b1ba89b18589978f7d7c2379afc7d86b6b1a148e509d90cc0bb5

Download Submit
memory/2708-20-0x0000000000EE0000-0x0000000000F61000-memory.dmp

Filesize
516KB

Download
memory/2708-15-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2708-11-0x0000000000EE0000-0x0000000000F61000-memory.dmp

Filesize
516KB

Download
memory/2708-43-0x0000000000EE0000-0x0000000000F61000-memory.dmp

Filesize
516KB

Download
memory/3632-37-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/3632-38-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/3632-39-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/3632-45-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/3632-46-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/3632-47-0x0000000000550000-0x00000000005E9000-memory.dmp

Filesize
612KB

Download
memory/4260-17-0x0000000000E20000-0x0000000000EA1000-memory.dmp

Filesize
516KB

Download
memory/4260-0-0x0000000000E20000-0x0000000000EA1000-memory.dmp

Filesize
516KB

Download
memory/4260-1-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing