urelas | 49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe
Size 125KB
Sample240323-yy2lfabh47
SHA256 49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715
MD5 dd790df74a1245df2495d046a031518a
SHA1 7ab6f05a7d5b688bfebcf4c9839f420c024626ff
SHA512 b91efd11d598bd520088d5fd82fa5e270b5529fab5d68c4852996eac5cda1c51d59a294bc2ecf892648bcaaf6cd020ef3e350d61e09cd6f9e87bcd7b28756352
SSDEEP 1536:Ko6JdvxttIBcXISDPV2Mhg3GkFceersWjcd06UsfqW2vxq6UUg:iHC6D92O8n7eU06UsfUpqP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.209
112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe

Executes dropped EXE 1 IoCs

pid	Process
1264	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1264	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	94
PID 2724 wrote to memory of 1264	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	94
PID 2724 wrote to memory of 1264	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	94
PID 2724 wrote to memory of 4024	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	95
PID 2724 wrote to memory of 4024	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	95
PID 2724 wrote to memory of 4024	2724	49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe	95

C:\Users\Admin\AppData\Local\Temp\49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe
"C:\Users\Admin\AppData\Local\Temp\49256d8a451152c38549315b83af36eac4c765064a7172d4a3cc4e85f4b74715.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 125KB
SHA256 5c076adb8590bcc84c53624d9d28369f27170f2c20f5c5661288f4b592ec5f7c
MD5 491077d0a539b33718621c28200f7f0b
SHA1 ad70663b312e2dae8a609b417a6bd67442348f06
SHA512 222ccb90db2ad82672a0342db608746477e14c4047e19d512846e988a665dc2f637f4f6602dcf73dfd02822a45a1497938977529036ceb31f14d2ec95f0defd5
SSDEEP 1536:Ko6JdvxttIBcXISDPV2Mhg3GkFceersWjcd06UsfqW2vxq6UUC:iHC6D92O8n7eU06UsfUpqp
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f28d96334bf66f634f899c800b4d5c6195bcf407cb073761f8a4f30a4061f136
MD5 d8b6fb23d659bed3f6b1cf40a104e95a
SHA1 07c9c74af6b0fe9b78bb1b3aed5bdc1e0b5de952
SHA512 e841cd9283c63a92395b4221492e2ae6b06d9c4108fcbbfe7d8a7928cfca405c14c0634a6388a4f18da3db611696ea797f9b825ed314d1640a17aa767593e412
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 2564326e5c5ea264ba3089afa7899e4af4c073b9f467196a5d3cc36e8e5bd624
MD5 8a788e79c9dd39c65cbfecc7d996db67
SHA1 4e4a87be712dd947be77416de788f35540252a49
SHA512 0d796e80eb21c9be9f176e283aa07cb64a5cd1f43d2707e2cd40df115f611c24d3de0382db6244e3c8c48693f1ecf35106c93e4694b3143915991347d9edc02c
MD5 SHA1 SHA512

Submit Download

memory/1264-14-0x0000000000820000-0x0000000000848000-memory.dmp

Download

memory/1264-20-0x0000000000820000-0x0000000000848000-memory.dmp

Download

memory/1264-21-0x0000000000820000-0x0000000000848000-memory.dmp

Download

memory/2724-0-0x0000000000EA0000-0x0000000000EC8000-memory.dmp

Download

memory/2724-17-0x0000000000EA0000-0x0000000000EC8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads