urelas | f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe
Size

147KB
MD5

122546810d8b94f304f3bb5850cdd6d7
SHA1

cec6d007c7ba37c1300be344958aa37533f57c31
SHA256

f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee
SHA512

e4eb1ae92fe50e42d78f95d8eab0232b233d5f0dbb07c95f1440e6cc008a3659576faf4c3ed6e7bb9c285b96d63c084f5266ab7d44dd1d2f8bd076e5577d25f5
SSDEEP

3072:L/5FqCxiXEcO3XfGf2tMUW6o5gRwdllDzX3R:L/5FqCxUElfQDR5gRC3nR

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2672	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1768	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1768	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	28
PID 2112 wrote to memory of 1768	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	28
PID 2112 wrote to memory of 1768	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	28
PID 2112 wrote to memory of 1768	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	28
PID 2112 wrote to memory of 2672	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	29
PID 2112 wrote to memory of 2672	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	29
PID 2112 wrote to memory of 2672	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	29
PID 2112 wrote to memory of 2672	2112	f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe	29

C:\Users\Admin\AppData\Local\Temp\f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe
"C:\Users\Admin\AppData\Local\Temp\f7b0b3292ce6d3e1b488f1edcabcd1e58b5a7070fac7d5e7ff93e17ceaae38ee.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
147KB

MD5
5950bf628da32ebce839412b3b053bfd

SHA1
0e5983be737aa4ad935f20ef53953bdaa96c0365

SHA256
4dca586bb074671e3c71864e07a2e71e024a1aa6d5e39b03aadad4dcbf14bfa8

SHA512
b9683889e4763b786c7c32004b9df7df4791fefe058931c53f27a2cd16db959d2b8e4be686d1c85193a8a40b4fd4d8d43dd6afe03954a4ee9747a6d3d658d6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e2d9c84d22710b94f88db5e136efd92e

SHA1
5636678dda45ea10068357a9b17878399804aea3

SHA256
91377fdab72045adb923f62c3b0b46de7360e62beaab96489eefb36dd8554f25

SHA512
11159ba71474c0fc20139e27d71e10349b486d17cdd60a1df93babf9d8f40d8ab0764a881b93472e03036a50735b2b3defc790da5519d8cf723c6de46b008f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
cc15667dec013bd611743b49f9656b21

SHA1
b7b8e71c0c80b3e3e695ec50701f9f4b5fa27f8a

SHA256
dac56558923aba0ffaa3d900d2941673768a423151c87638e5ff9b7b3db75e1b

SHA512
76accf013ff0eedd1abb79145ea60eabf897f979eecefefe83f04d31e181b9d8b8d3b985ddba216f75f8fcc4bcecb5fc905961a137f30562c2e9d27c17442270

Download Submit
memory/1768-16-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/1768-21-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/2112-0-0x0000000000350000-0x0000000000377000-memory.dmp

Filesize
156KB

Download
memory/2112-9-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/2112-18-0x0000000000350000-0x0000000000377000-memory.dmp

Filesize
156KB

Download