urelas | ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb

General

Target

ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe
Size

336KB
MD5

af16791ad664dbfb2e700be33ef6833e
SHA1

200af680d9afd7478405ce73100275eb26dc451b
SHA256

ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb
SHA512

03b59cbff8889d256946b36507d8c460cc74536e76a52ed76c39bdb2b4c7f32d22ce2c33870a521cad376c759a85d6d4b4b08406916b7d566cfd0b3dd2b7c40e
SSDEEP

6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYIrc:vHW138/iXWlK885rKlGSekcj66ci6

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

218.54.31.166

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	oxnab.exe

Executes dropped EXE 2 IoCs

pid	Process
244	oxnab.exe
2996	dibol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oxnab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dibol.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe
2996	dibol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 244	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	83
PID 3784 wrote to memory of 244	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	83
PID 3784 wrote to memory of 244	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	83
PID 3784 wrote to memory of 4420	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	84
PID 3784 wrote to memory of 4420	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	84
PID 3784 wrote to memory of 4420	3784	ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe	84
PID 244 wrote to memory of 2996	244	oxnab.exe	103
PID 244 wrote to memory of 2996	244	oxnab.exe	103
PID 244 wrote to memory of 2996	244	oxnab.exe	103

C:\Users\Admin\AppData\Local\Temp\ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe
"C:\Users\Admin\AppData\Local\Temp\ec13597d4586e4bcf8577a5a63494831e28cfedd1a763fb9cd7116de155e8afb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\oxnab.exe
  "C:\Users\Admin\AppData\Local\Temp\oxnab.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\dibol.exe
    "C:\Users\Admin\AppData\Local\Temp\dibol.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
340B

MD5
b4e79e0f794ffabf6e410d4b9d8ab9e2

SHA1
6f8bf0c97b7d39bd1603de5d4132db36ce0b402f

SHA256
4bf337a3b57c15ad8b0975636630e8db677a9c8301a5566dab44a584b1205be2

SHA512
9b955287ecf2d8f385d1235357fada05901cbd75572556d9efc4eb12073d3b7f34f190e53c3c8668db98cb5357f65c4fa2531cad26eaa85bf25011559570ec6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dibol.exe

Filesize
172KB

MD5
c88bfc01dccc521301598b2f5b03fa71

SHA1
9302b616838d07b1fbb54b7b490eb6d8ea637c93

SHA256
3969cddd19a81573146d9eeafb61cdc86dfcfaa7c6bc7f522548b593bf8f9faa

SHA512
0300a475e1ab8a06748c737d6ac901b57e2ad710b47a344b0aa108f91139ca9bdc20c909ec5ded7596186ef0e7f6b89f7d80ddfef35bad53bc221cd1f988b649

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
3ecafd3c91f08af8860448b4669cace7

SHA1
1a9c0b405d08a474bb9ae12947487066d9f61afa

SHA256
61e5e1375d0e1fa55ed13b7bb869a144619d16a9e080b5300255fc8546c6d247

SHA512
29acc1c05aed4472e6a7d928e77bb9ee4726ad09ce6c61a0c3ce39b7d5943baaeeb3ca3e3aa96a5dff4e1969efc93260219387b292246b3a133458a63fb3a8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\oxnab.exe

Filesize
336KB

MD5
bbebabd18581eeb3b9ef3a0b0fe76b2e

SHA1
c3d4b072eca4aa9d1b4a0281d8568407e02cbdf2

SHA256
6abf4036220a3c45586a50b82b6bbb46c23e782ff0d4df906750c2c9540264b8

SHA512
bc206c063007d0977a873e17e57db93009bd24b46eb96f2e063d0e6a46656383a031846b469f87336982bdbd45842d247138da11df835d2b3f933c9ca5a26c4f

Download Submit
memory/244-21-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/244-20-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Filesize
516KB

Download
memory/244-11-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Filesize
516KB

Download
memory/244-14-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/244-41-0x0000000000D20000-0x0000000000DA1000-memory.dmp

Filesize
516KB

Download
memory/2996-42-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/2996-39-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/2996-38-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/2996-46-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/2996-47-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/2996-48-0x0000000000540000-0x00000000005D9000-memory.dmp

Filesize
612KB

Download
memory/3784-1-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3784-0-0x0000000000F80000-0x0000000001001000-memory.dmp

Filesize
516KB

Download
memory/3784-17-0x0000000000F80000-0x0000000001001000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing