urelas | 00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71

General

Target

00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe
Size

336KB
MD5

5b6f90438f5b1e6310e8b2e2defd3b70
SHA1

f05d56b3033c00acb4d4b1fd185f6a51609edb2c
SHA256

00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71
SHA512

34bfa93b039e3ae68ff8559cfde5a536f90e271d8354c07d4d6f6df16afcb1e1b03e36238f06b82eed788d96b7f22b976831876d1922d602bfecd9fea101a51d
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYIcKofQ:vHW138/iXWlK885rKlGSekcj66ciF

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2936	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1652	ramip.exe
1760	hyidk.exe

Loads dropped DLL 2 IoCs

pid	Process
1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe
1652	ramip.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ramip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hyidk.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe
1760	hyidk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1652	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	28
PID 1860 wrote to memory of 1652	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	28
PID 1860 wrote to memory of 1652	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	28
PID 1860 wrote to memory of 1652	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	28
PID 1860 wrote to memory of 2936	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	29
PID 1860 wrote to memory of 2936	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	29
PID 1860 wrote to memory of 2936	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	29
PID 1860 wrote to memory of 2936	1860	00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe	29
PID 1652 wrote to memory of 1760	1652	ramip.exe	33
PID 1652 wrote to memory of 1760	1652	ramip.exe	33
PID 1652 wrote to memory of 1760	1652	ramip.exe	33
PID 1652 wrote to memory of 1760	1652	ramip.exe	33

C:\Users\Admin\AppData\Local\Temp\00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe
"C:\Users\Admin\AppData\Local\Temp\00beca69e33195437c35687cc54718329808df1d36cc982b1a253dea14998d71N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\ramip.exe
  "C:\Users\Admin\AppData\Local\Temp\ramip.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\hyidk.exe
    "C:\Users\Admin\AppData\Local\Temp\hyidk.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
758723cbe06bbdab92d388cd053583dc

SHA1
bc82a8ba474d69530d2d82ebdaf601a16ded86d9

SHA256
5fede1a7ed6e11fe49824c4451022ca3dacb37792d6ba9cca8b3f8997fb7a35f

SHA512
e4f1f7fdc62b23a8470db2e95103920e8778743951e591e11aa5653f17e737a89c92c918dcafa408efd932598f5d6d3675fc0eeb48242f043bb427aee6cf1f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f668168ead3912b4a8133489b67f46fb

SHA1
1c79c9d13418779737892fc69df2ce447c03b02f

SHA256
f79b09c5caf34bedea490e70eb887ba48805c5ac40a803a219a064f9e7c309c2

SHA512
ac5cd9f17ce1b6e82df22aba33fe9b6b83c5f33115b980ef10952c4e778d5d351bd5b35c149275901487f11c54490ab84c3c4058c0e21684fe90365e20c317e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ramip.exe

Filesize
336KB

MD5
d1b8c45c4f08a3e702fbd93cefbe1799

SHA1
991b4012059abdcc81c56555cdd17f41dbe12823

SHA256
ed7a602da2f90871af7c239b8a888b2f1b90ca22b1692a7847ac4960a9b91bd7

SHA512
4d256b37408e1092da078516b86fb3f8bacbd6f638a3e87eda508390141adf57fc773b123687238e2a6a6ba771a144170c8bd28d7bbe979ac286e5b8a74a85ef

Download Submit
\Users\Admin\AppData\Local\Temp\hyidk.exe

Filesize
172KB

MD5
b064c8fe0953983bc47d0df42d2ead48

SHA1
766f41630312302069b8b0ffc8a96e29605a2973

SHA256
02737ba165e3b8d383d11eefeedb34945b134e0a731c260ffacbbd1d5eccab3e

SHA512
ea376decbffce4e7364971394366896ba804fbda5c68363acda1b38d72b9b40e0739b0d8c3774b452a6fb470d805445cd8762f26b8fb406705a03fedd50f98a4

Download Submit
\Users\Admin\AppData\Local\Temp\ramip.exe

Filesize
336KB

MD5
cc73dff9716579ed0c8ee19c252ba2d8

SHA1
144ef38de7ac9025e93d41a4575efb6e3c1106c4

SHA256
057d86949051c48f1c37b0d07271b49168a0960e14670305baeeb7d168841ab2

SHA512
94f373bc88d201802da559a6edc97345b494f4fc76f3283918e0964e9cd2c276334987de23798ab17fe960a1d08e57b854d1ef264bef98285f3d07d0f8e77a20

Download Submit
memory/1652-40-0x0000000000010000-0x0000000000091000-memory.dmp

Filesize
516KB

Download
memory/1652-12-0x0000000000010000-0x0000000000091000-memory.dmp

Filesize
516KB

Download
memory/1652-11-0x0000000000010000-0x0000000000091000-memory.dmp

Filesize
516KB

Download
memory/1652-24-0x0000000000010000-0x0000000000091000-memory.dmp

Filesize
516KB

Download
memory/1760-42-0x0000000001040000-0x00000000010D9000-memory.dmp

Filesize
612KB

Download
memory/1760-43-0x0000000001040000-0x00000000010D9000-memory.dmp

Filesize
612KB

Download
memory/1760-48-0x0000000001040000-0x00000000010D9000-memory.dmp

Filesize
612KB

Download
memory/1760-49-0x0000000001040000-0x00000000010D9000-memory.dmp

Filesize
612KB

Download
memory/1860-21-0x00000000009C0000-0x0000000000A41000-memory.dmp

Filesize
516KB

Download
memory/1860-7-0x0000000002590000-0x0000000002611000-memory.dmp

Filesize
516KB

Download
memory/1860-0-0x00000000009C0000-0x0000000000A41000-memory.dmp

Filesize
516KB

Download
memory/1860-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing