urelas | 4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9

General

Target

4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
Size

629KB
MD5

2636e72056b9ee9495548eb46a3a93d0
SHA1

9b5cda0964ceb190487911bab16225d5a4ee63bf
SHA256

4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9
SHA512

13b78f3360b657e0096e2c1e7b49e23d0a3470f4a04cb4a84a65ac3977a329e76751a3d7604ac4c0f9610036f124516315fe4d26a0ebdd57ead4672baa24066e
SSDEEP

6144:hmbmLppYOuakY1q5Q4XMxvQ4x1OpGcm9VQl0lM/oJ4/gupe10b:hma6id1Q8zzkGHVqoq/gI

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2796	erdig.exe
800	nokoi.exe

Loads dropped DLL 3 IoCs

pid	Process
2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
2796	erdig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erdig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nokoi.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe
800	nokoi.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2796	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	30
PID 2268 wrote to memory of 2796	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	30
PID 2268 wrote to memory of 2796	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	30
PID 2268 wrote to memory of 2796	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	30
PID 2268 wrote to memory of 2712	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	31
PID 2268 wrote to memory of 2712	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	31
PID 2268 wrote to memory of 2712	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	31
PID 2268 wrote to memory of 2712	2268	4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe	31
PID 2796 wrote to memory of 800	2796	erdig.exe	34
PID 2796 wrote to memory of 800	2796	erdig.exe	34
PID 2796 wrote to memory of 800	2796	erdig.exe	34
PID 2796 wrote to memory of 800	2796	erdig.exe	34

C:\Users\Admin\AppData\Local\Temp\4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe
"C:\Users\Admin\AppData\Local\Temp\4d9947f580ce0254f3197e05a8247eaab30183ad8b292e6a16fb64701c9c77a9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\erdig.exe
  "C:\Users\Admin\AppData\Local\Temp\erdig.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\nokoi.exe
    "C:\Users\Admin\AppData\Local\Temp\nokoi.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
342B

MD5
ab81a7cae5f3b4956a813b265151742e

SHA1
0912a00360776619b058187136f3d14420df14f3

SHA256
ca2f14247effbc1b52a50c0763ce0d180d482399ee8f485c185a9a41afc3973f

SHA512
ee0da9c1db68586c2d2a8b4bc8cecfd6cb6023445b38f1f765080c1438d09ed786493453fc16a62d070c8c375f0f0c1002e5ecc4027ed677c01116738abbcbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
fdb141c2f4d7eddb2c151e4fbe1f2535

SHA1
9575b5415369861ceffdb365d4ffdaeb25e6370e

SHA256
9dea92012650244da9e9cf563943cc5cd80723177e8f9a5c55109b44a558f38a

SHA512
b1714d86b551e25877e9c1ab92c3e3ad6312168e12d58893a5e9ef234d9de532f1ac0e0014d46fd28554ef19d47821a63864b0dfd78e869e63e23adef9a9f5b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nokoi.exe

Filesize
203KB

MD5
425bd9850ada8b72baf2433574c1113b

SHA1
76b7e68f62a5a9751ba6ffbb197690c7f678355d

SHA256
3982e23405277da725d4f0bc074bfba2199adbb99ca30fab6d49ad2069c5502b

SHA512
36a7d1921755c7eb3370e383839dab038030d55d5b99bfda76b3a89cc6f6c09c5d36f1612e2fd3eb9a65f3b561b7b662c20561b81774f2fb9efb12f00c39db6f

Download Submit
\Users\Admin\AppData\Local\Temp\erdig.exe

Filesize
629KB

MD5
012020a1f88612c2f121369d65e5a6ab

SHA1
b86390acee86267fb804db85701cd9b8b8a9243c

SHA256
d78db5fbc444c5473069f973e2b745946f0e04e97b91c948e7a6b6f223b2d540

SHA512
ef03b1095abcde37b2ae14f1e92beb63c395c781ea2ad249834b2bf749ef8cbaa90c62514ac25c5bbc02f3ffc1cef4b172dc57cbddff9aaed07205e218f9f389

Download Submit
memory/800-33-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/800-35-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/800-36-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/800-37-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2268-11-0x0000000002500000-0x000000000259C000-memory.dmp

Filesize
624KB

Download
memory/2268-22-0x0000000000400000-0x000000000049BADB-memory.dmp

Filesize
622KB

Download
memory/2268-12-0x0000000002500000-0x000000000259C000-memory.dmp

Filesize
624KB

Download
memory/2268-0-0x0000000000400000-0x000000000049BADB-memory.dmp

Filesize
622KB

Download
memory/2796-25-0x0000000000400000-0x000000000049BADB-memory.dmp

Filesize
622KB

Download
memory/2796-20-0x0000000000400000-0x000000000049BADB-memory.dmp

Filesize
622KB

Download
memory/2796-31-0x0000000000400000-0x000000000049BADB-memory.dmp

Filesize
622KB

Download

Analysis

Sharing