urelas | ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248

General

Target

ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe
Size

341KB
MD5

09b5ac695ecb26f5923167783af898a9
SHA1

f78da648815348fd48e1ff6c1ceedae215517e1e
SHA256

ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248
SHA512

0d71c6709e2ec28c5f9b04efefb618f63ec551c2693c5f90cee9658495a46471ae83dc0ae7a2dc63ea0ca036d8cd2dc02aa7df9f05d944e0300de9ad592a1f14
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYRcECHUI:vHW138/iXWlK885rKlGSekcj66ciaC0I

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	xaanf.exe

Executes dropped EXE 2 IoCs

pid	Process
1964	xaanf.exe
1684	biuvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xaanf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biuvw.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe
1684	biuvw.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1964	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	83
PID 3744 wrote to memory of 1964	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	83
PID 3744 wrote to memory of 1964	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	83
PID 3744 wrote to memory of 2676	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	84
PID 3744 wrote to memory of 2676	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	84
PID 3744 wrote to memory of 2676	3744	ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe	84
PID 1964 wrote to memory of 1684	1964	xaanf.exe	103
PID 1964 wrote to memory of 1684	1964	xaanf.exe	103
PID 1964 wrote to memory of 1684	1964	xaanf.exe	103

C:\Users\Admin\AppData\Local\Temp\ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe
"C:\Users\Admin\AppData\Local\Temp\ca8f7a3df2b8247a527e4c560eb897c746e63d0cb413753e5c0759c0a746c248.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\xaanf.exe
  "C:\Users\Admin\AppData\Local\Temp\xaanf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\biuvw.exe
    "C:\Users\Admin\AppData\Local\Temp\biuvw.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
b7f738828e7994f6100e64d268f74324

SHA1
eb8d5fb479fc449fed54c2a3f3442ca1eb09e30b

SHA256
c55069323b429916772859606722ad8928ea6ed8a005a649589bed8f7fffd5bf

SHA512
8b1a8e647a6f14ed1cdb403b0eb29659a83fb2928740c373851f37e0fa41fe8ebdf9a313bf98d910fe43f369c806328e88132b9c10cf0199b66e7443d63a0cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\biuvw.exe

Filesize
172KB

MD5
fbbed57c224ffa4a763d931427d9562d

SHA1
1dc721452bd2093edd8f3f7dc9c7812717181c95

SHA256
ba3d8a2988cc1a89183831ee47f59bba0d02e7d51ba2e89785f653bcdda8bf2f

SHA512
58bf4ddcfc52a1498c80bf732d3899a0b5b7836a192d1fd588a7e291592a0189ad4391befdd1498f9434eaf7ce7a28244f3a7066336133aeb04a4bc5de6a9a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
dee062898d34f9eaf24f2be576e0d35f

SHA1
61e4140f3f3959331c956b9f5056051281327947

SHA256
ec493e2ad24ba2191b50e1f4d4c490462e7e8e9c258baf369fc41540d838edf2

SHA512
b9201b2ed10d8c7b289c217fc1bd84b9fe569a3286715080403e439aca549dfdcccf58a7fdb131351ed1f749ea00d95f4570599a5e29c84a00739c841e678440

Download Submit
C:\Users\Admin\AppData\Local\Temp\xaanf.exe

Filesize
341KB

MD5
41c692d74f7eb122f87de9cd4e587a12

SHA1
3c636ab1cbbe67c9c41e8a8cc5bebf2a34e679e1

SHA256
dd29e10394a391a27b4e20597c4c6dd1689bc847f9a21e4119f551b6e1ffd364

SHA512
4558fff3dc71c37bcd67dfff52e36a96faa20e2721bbab17a008513f2fdd1807b4e04eedbdbd9b5b4d26bfa95c96e8503a44e769a1fc8d426f13ec9b7901ee88

Download Submit
memory/1684-47-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/1684-46-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/1684-38-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/1684-44-0x0000000000B60000-0x0000000000B62000-memory.dmp

Filesize
8KB

Download
memory/1684-41-0x0000000000DC0000-0x0000000000E59000-memory.dmp

Filesize
612KB

Download
memory/1964-14-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1964-21-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1964-20-0x00000000006C0000-0x0000000000741000-memory.dmp

Filesize
516KB

Download
memory/1964-40-0x00000000006C0000-0x0000000000741000-memory.dmp

Filesize
516KB

Download
memory/1964-11-0x00000000006C0000-0x0000000000741000-memory.dmp

Filesize
516KB

Download
memory/3744-17-0x00000000006E0000-0x0000000000761000-memory.dmp

Filesize
516KB

Download
memory/3744-0-0x00000000006E0000-0x0000000000761000-memory.dmp

Filesize
516KB

Download
memory/3744-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing