urelas | 106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0

General

Target

106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe
Size

336KB
MD5

184521dc985f9347420decd07ebb3d1a
SHA1

a97891c7a46cc0cc8e88a8d60ef4c7b91044d136
SHA256

106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0
SHA512

0c5b90441faf0057e8016f6dc696acd7860eb0cf7884f110299cf7727a249588a5cf7bbb76c2633113521acc71956e449eb07cf8cc52f54eae5831d4537a9d93
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYIcKv:vHW138/iXWlK885rKlGSekcj66ci3

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	vilod.exe

Executes dropped EXE 2 IoCs

pid	Process
116	vilod.exe
3652	nirym.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vilod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nirym.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe
3652	nirym.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 116	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	83
PID 2276 wrote to memory of 116	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	83
PID 2276 wrote to memory of 116	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	83
PID 2276 wrote to memory of 2980	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	84
PID 2276 wrote to memory of 2980	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	84
PID 2276 wrote to memory of 2980	2276	106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe	84
PID 116 wrote to memory of 3652	116	vilod.exe	103
PID 116 wrote to memory of 3652	116	vilod.exe	103
PID 116 wrote to memory of 3652	116	vilod.exe	103

C:\Users\Admin\AppData\Local\Temp\106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe
"C:\Users\Admin\AppData\Local\Temp\106a93d92afba2835a8d35b6b8477dc618e300a552dec4e12c6edc34794280b0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\vilod.exe
  "C:\Users\Admin\AppData\Local\Temp\vilod.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\nirym.exe
    "C:\Users\Admin\AppData\Local\Temp\nirym.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
cf966dec08dde4c3034c5a706d158e3b

SHA1
c33b0e814351a9171961f81f518bff55e4d8869a

SHA256
017d9fabd48f983facaa2620c870ebe44f8d0ef5eb7dda609fd87825b4c68ca1

SHA512
1a559c741e53669a9459b3bef758016c4819f58dac75209caf81be1e9f86bd2be89b3d09e6529931d834821c994fe4503e229b3ec29b8d2e598e7ea4077101ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
719b67bdcc49531b48198adf1d20c5b4

SHA1
211c66b8c2f0834ab3fc256d6944e7a4cf0dd706

SHA256
f4aa0e1f90b0f55ef413f2ab84737dabacaf0d5378c87bf3c9d48768d99cc540

SHA512
1c132a9eba9ada8858bed911e9ce66583cdf8a9cda6d291bc3f6261399c7f9934d4f4cdbd7c895caedb8775231d270330787be5ebacffc59ed048ecbdc9a48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nirym.exe

Filesize
172KB

MD5
184110d97afb73af6d54ab028e73c1aa

SHA1
22e338c0cc8239ff39b042b3d30e15240968393c

SHA256
6926da885e905dac5cdb3afd3e6dbf2f4d2f26c46fee6ce54df863fa931d063f

SHA512
3514d1bf490796b9f868f39d717ba15d0a319931bf162ce441ed4a1d75aa3c46be457dc3e4958a78a613332868bd00e20b0fe621de04d87504569e2e3860d59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vilod.exe

Filesize
336KB

MD5
42f2a481f61015f7992d7e2e06a7496d

SHA1
aa1576ae92cc42530d6e576a12705aaa3c5de685

SHA256
e1ad958e177ed17d67541ce703cc2f2477b191fd201b6e4bc194a44309611c04

SHA512
ab4660950dde5a982178425ad7acc25b742f313e1942c64b866b3418cc975cf039bfaae75410707f0c4da39bea3c0e869af04f4e6f926f9a7ce53bd02a5e03cf

Download Submit
memory/116-19-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/116-12-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/116-13-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/116-39-0x0000000000360000-0x00000000003E1000-memory.dmp

Filesize
516KB

Download
memory/2276-16-0x00000000008A0000-0x0000000000921000-memory.dmp

Filesize
516KB

Download
memory/2276-0-0x00000000008A0000-0x0000000000921000-memory.dmp

Filesize
516KB

Download
memory/2276-1-0x0000000001100000-0x0000000001101000-memory.dmp

Filesize
4KB

Download
memory/3652-36-0x00000000000A0000-0x0000000000139000-memory.dmp

Filesize
612KB

Download
memory/3652-40-0x00000000000A0000-0x0000000000139000-memory.dmp

Filesize
612KB

Download
memory/3652-37-0x0000000000F90000-0x0000000000F92000-memory.dmp

Filesize
8KB

Download
memory/3652-45-0x0000000000F90000-0x0000000000F92000-memory.dmp

Filesize
8KB

Download
memory/3652-44-0x00000000000A0000-0x0000000000139000-memory.dmp

Filesize
612KB

Download
memory/3652-46-0x00000000000A0000-0x0000000000139000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing