urelas | 8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2025, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
Size

541KB
MD5

e848cc55bb658894a350d1c853a1567b
SHA1

d6e57e2c4ade50f89ee9a5b48268bfab2e9db001
SHA256

8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f
SHA512

32b495ec4b7674a5750e8c63b2fa5bd4af7ccef8c9d556f82c1ea2555b1c78719495e78064615e37fad9358d07c2ec6f031d2b751abb724deff26e2be6d82af9
SSDEEP

12288:T52PxDgZo3ijnieactYDG7MzZSHJcvEj8dmoSxuz:92SLi70T7Mifju

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	motuh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe

Executes dropped EXE 2 IoCs

pid	Process
1612	motuh.exe
1044	heajz.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3540-0-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/files/0x000a000000023b4e-6.dat	upx
behavioral2/memory/1612-12-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/3540-14-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/1612-17-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral2/memory/1612-28-0x0000000000400000-0x0000000000487000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	motuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heajz.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe
1044	heajz.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1612	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	82
PID 3540 wrote to memory of 1612	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	82
PID 3540 wrote to memory of 1612	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	82
PID 3540 wrote to memory of 976	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	83
PID 3540 wrote to memory of 976	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	83
PID 3540 wrote to memory of 976	3540	8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe	83
PID 1612 wrote to memory of 1044	1612	motuh.exe	94
PID 1612 wrote to memory of 1044	1612	motuh.exe	94
PID 1612 wrote to memory of 1044	1612	motuh.exe	94

C:\Users\Admin\AppData\Local\Temp\8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe
"C:\Users\Admin\AppData\Local\Temp\8a72a00503f6165cdb13acd74fca6e49837c99892582b19c420c0777ce32764f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\motuh.exe
  "C:\Users\Admin\AppData\Local\Temp\motuh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\heajz.exe
    "C:\Users\Admin\AppData\Local\Temp\heajz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
861670fb312741d9ad76a7cd2b118d15

SHA1
c43025026fc13dce81c028889695c5c06754bc40

SHA256
b15a683b135b842ef5af69a208694749e49eb14ef43cccd9528295e0657d2bbf

SHA512
f12f5a07cc26de42d069a433b4795d47ace58bad8d1ee5b7accac74361fb101e12334258326a0409a80b874ed9ffd0a03603762d8e259ebd0306a52fb410fd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
05c347182b8d032fd58978800a2138e3

SHA1
b24a0700b48068609bce3c107778edb81085f78a

SHA256
59a86dcca98d8f727afa541b935cdf4319687ca96946abf828a0224ce5594473

SHA512
9a5ce3d0a01c35c50b3097fef5e1f96d20cb4c83cb8fb8e537775db98be2f7fdcb72221c1c7c2596606422f36316b55e30fcc84870e5abfe1b162216c95768c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\heajz.exe

Filesize
230KB

MD5
8bb96356b50040d1909f674d264f5162

SHA1
7deb012d8f640bfcf52d203eb84387cce4af9a1e

SHA256
fa33f9522f23e1490435cd210adcf98ba8fc09c5e483dc533d426971b73020da

SHA512
e58d5c96a1e498f71b5654012c7815d0af554ac277851ab82599129e12b16a2cee10a8276778835af8c71d76d25ab6047c582e20013d1d094fe3f20e7c2d0c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\motuh.exe

Filesize
541KB

MD5
604d50924475c801e5dc845613ab6b6f

SHA1
3244dcdd68a163f8cec51f79dc86378f8b2139ee

SHA256
bbac700d2590c39f405e8d172519f30411f151209df82b92807316c0c4306210

SHA512
938de54e1b0b35cbe3a8af90df84230bae484ca144e2ed320133b7c4161017ca6058e765266278ba327d2a8261cdfefd4798867e46542e0fb06731be732a1f38

Download Submit
memory/1044-26-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1044-27-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1044-30-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1044-31-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1044-32-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1044-33-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1044-34-0x00000000007D0000-0x0000000000883000-memory.dmp

Filesize
716KB

Download
memory/1612-17-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1612-12-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1612-28-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3540-14-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3540-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download