urelas | c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe
Size

59KB
MD5

b5c3c442a147dd5bda28b6340d5d0ddd
SHA1

ec5514e43aa8d003523918174f389143e278c364
SHA256

c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db
SHA512

e87ce85c476800725bfc5595f186fb9f82f076666b4bdce8a67e86a5f59d2a83c3ef3d0ebb5931eec2ad85734d77c4a4732c1379eeb3eb5b6de240a6457ce36e
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVn:Jo0cAthu6+FQ0JuPkn

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2956	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2956	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	28
PID 2924 wrote to memory of 2956	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	28
PID 2924 wrote to memory of 2956	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	28
PID 2924 wrote to memory of 2956	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	28
PID 2924 wrote to memory of 2544	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	29
PID 2924 wrote to memory of 2544	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	29
PID 2924 wrote to memory of 2544	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	29
PID 2924 wrote to memory of 2544	2924	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	29

C:\Users\Admin\AppData\Local\Temp\c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe
"C:\Users\Admin\AppData\Local\Temp\c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
10aa36988e384c11c79b3252fb63fe8a

SHA1
8f1a50076022daa208eadb87ae10112f1ee0d155

SHA256
1f142df82524c75767846ca2306fb6ddaeb5b3aed5e53fecf98ddf099790ecac

SHA512
498315539cc88c4517fa07d9106e3f8d38699ce9c8ecdd346c5f447f822fb234b26fc47611683b9f9e2c634cdc987eb6f9454814aeccd589f491bcd26e91edce

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
f14611a95b63c85301861c79b42481b1

SHA1
91c2b19ac1fe3a0cf132e96288e8e1ca0afec0bb

SHA256
3a7343a8dc4867f423056a7389a3f3942a5e368cecc165bfe8cdb31c3f60bf21

SHA512
1a4d6e2c5d899daa69089ce0806c8b760783b854b5ead4cf62a4ffc1bd20655ae6f6339c1c20f15b20e7afbd193d6885d10acbe5c26a64aa27a1cea51cf950ef

Download Submit
memory/2924-0-0x0000000000210000-0x0000000000235000-memory.dmp

Filesize
148KB

Download
memory/2924-9-0x0000000001DA0000-0x0000000001DC5000-memory.dmp

Filesize
148KB

Download
memory/2924-17-0x0000000000210000-0x0000000000235000-memory.dmp

Filesize
148KB

Download
memory/2956-18-0x0000000000150000-0x0000000000175000-memory.dmp

Filesize
148KB

Download
memory/2956-21-0x0000000000150000-0x0000000000175000-memory.dmp

Filesize
148KB

Download
memory/2956-23-0x0000000000150000-0x0000000000175000-memory.dmp

Filesize
148KB

Download
memory/2956-29-0x0000000000150000-0x0000000000175000-memory.dmp

Filesize
148KB

Download