urelas | c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4

General

Target

c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
Size

868KB
MD5

e114ad9017c59a2e93648082880950ea
SHA1

009b0747726a454101fec16dbbaaa840a9e454c7
SHA256

c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4
SHA512

bc304bf8ec18f84062e31e5d1cf6108c1ae7c1fbab71ff8309d24bc0d4f0852da95a93a07f498ddfef91933f4ca1aa5c06ef1c20fb48dc0e4fd5a46e7cf1abb3
SSDEEP

12288:BO2QLxzVhdf+5utolnQux+GthLM2X4hVc+5Y+vWcg4RalJaCvHl0h9RMXlRkb:BaLza5uDugu/CIwLkJlH2h9a16b

Score

10^/10

urelas discovery trojan

Malware Config

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	juedy.exe

Executes dropped EXE 2 IoCs

pid	Process
4524	juedy.exe
1576	mogiu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	juedy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mogiu.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe
1576	mogiu.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
Token: SeIncBasePriorityPrivilege	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
Token: 33	4524	juedy.exe
Token: SeIncBasePriorityPrivilege	4524	juedy.exe
Token: 33	1576	mogiu.exe
Token: SeIncBasePriorityPrivilege	1576	mogiu.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4524	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	83
PID 4692 wrote to memory of 4524	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	83
PID 4692 wrote to memory of 4524	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	83
PID 4692 wrote to memory of 32	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	84
PID 4692 wrote to memory of 32	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	84
PID 4692 wrote to memory of 32	4692	c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe	84
PID 4524 wrote to memory of 1576	4524	juedy.exe	103
PID 4524 wrote to memory of 1576	4524	juedy.exe	103
PID 4524 wrote to memory of 1576	4524	juedy.exe	103

C:\Users\Admin\AppData\Local\Temp\c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe
"C:\Users\Admin\AppData\Local\Temp\c5ca498e477c55a92617725bfb977c377bb257896925ddcb0bb658a9b09939f4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\juedy.exe
  "C:\Users\Admin\AppData\Local\Temp\juedy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\mogiu.exe
    "C:\Users\Admin\AppData\Local\Temp\mogiu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_sannuy.bat

Filesize
340B

MD5
3d19ac93e1427854771f41ffc2c87036

SHA1
7d3f061bb9608e83c0e3e201d7ea2b1d68e0a81b

SHA256
ba69b131b863c2b2dee0f7d022020aa0715d53f69e671e2392c10c92f085623e

SHA512
c3a0b301122d7d602f83d4581891c4a1cf1fac965f5fe67eff7ef7d85e64d92c75a00ee60cd7e80ced0e66e138f98a0bcc092659d5afbdfbed2bf252d1ce0102

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
5f49f638772933db6cf8d9db0650edfd

SHA1
16899b3b33ac3b64c4c6a9c9cba4439cd903d58e

SHA256
641eb244e006f327a36daed4cb8ec358dd4abe027894f26dbbe28296ef493960

SHA512
fdaa73cebd0f6283ffb6341b8a03e39614755d6f96440fb32e14c6e13c6c75503639f62d9fa3422171266b73a2a74cdc21e3f0b3475a593ef01149d0b0b03439

Download Submit
C:\Users\Admin\AppData\Local\Temp\juedy.exe

Filesize
868KB

MD5
35775e4d5b16c06e50b533365dd19187

SHA1
74a56271b968d7872c668795cfe60ac978f69899

SHA256
c3d156152a6d751596cb32c4dd6a437146d644d969ae0c032338ce8e6e9a8386

SHA512
c0c307e09a2c78a859eade2127f1d1fde2a4870a7173b795097cf0dabcb5643f353d9befe0a69d27d152215a2c7d8986bf3d35c1a06c967737c4b954d9d4b1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\mogiu.exe

Filesize
294KB

MD5
b845a3592fbb22d696a44080b2f7973d

SHA1
462a097b7ceb5b91ad0c665d42a4bb8ff42c7de5

SHA256
ade5863aa07f0460bdee4ea79491060ea46f45bce0b25ec3a4e299c67307417d

SHA512
d207c45a0087a2a31761b57e83c01743023f66ea9fbe94dd6ab2edd7e59843874c8184cc741e8efd24eb8bf296e7619eaa81d11cf444eb75c39adf130d0a3e55

Download Submit
memory/1576-46-0x0000000000180000-0x0000000000213000-memory.dmp

Filesize
588KB

Download
memory/1576-45-0x0000000000180000-0x0000000000213000-memory.dmp

Filesize
588KB

Download
memory/1576-43-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/1576-40-0x0000000000180000-0x0000000000213000-memory.dmp

Filesize
588KB

Download
memory/1576-37-0x0000000000180000-0x0000000000213000-memory.dmp

Filesize
588KB

Download
memory/4524-13-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/4524-20-0x0000000000E70000-0x0000000001049000-memory.dmp

Filesize
1.8MB

Download
memory/4524-39-0x0000000000E70000-0x0000000001049000-memory.dmp

Filesize
1.8MB

Download
memory/4524-12-0x0000000000E70000-0x0000000001049000-memory.dmp

Filesize
1.8MB

Download
memory/4692-17-0x0000000000260000-0x0000000000439000-memory.dmp

Filesize
1.8MB

Download
memory/4692-0-0x0000000000260000-0x0000000000439000-memory.dmp

Filesize
1.8MB

Download
memory/4692-1-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing