urelas | c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db

Analysis

max time kernel
142s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe
Size

59KB
MD5

b5c3c442a147dd5bda28b6340d5d0ddd
SHA1

ec5514e43aa8d003523918174f389143e278c364
SHA256

c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db
SHA512

e87ce85c476800725bfc5595f186fb9f82f076666b4bdce8a67e86a5f59d2a83c3ef3d0ebb5931eec2ad85734d77c4a4732c1379eeb3eb5b6de240a6457ce36e
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVn:Jo0cAthu6+FQ0JuPkn

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe

Executes dropped EXE 1 IoCs

pid	Process
4984	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4984	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	92
PID 4112 wrote to memory of 4984	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	92
PID 4112 wrote to memory of 4984	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	92
PID 4112 wrote to memory of 2520	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	93
PID 4112 wrote to memory of 2520	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	93
PID 4112 wrote to memory of 2520	4112	c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe	93

C:\Users\Admin\AppData\Local\Temp\c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe
"C:\Users\Admin\AppData\Local\Temp\c26a782f5aad8f55dca6e7eaa6f6872b3b9471735e3d54486f4ea11e70c099db.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
01f0cc91f16e0a62a6c09fc481c882b2

SHA1
6c3b6d7eb5e1ea3973585bbd90796fc1ec6bb1e1

SHA256
b5cfc0ae30f978a7b1af236327a5914662598ee66d01a7d430b6242f195a1a56

SHA512
2db84bd6674d2712b023ebc0e678aee1fe643fc98e2f11b7ce548bdfd442572161863dfe837d977969dc3a6d4363a79d95badb5351f422e8a7905b6d9638f42c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
10aa36988e384c11c79b3252fb63fe8a

SHA1
8f1a50076022daa208eadb87ae10112f1ee0d155

SHA256
1f142df82524c75767846ca2306fb6ddaeb5b3aed5e53fecf98ddf099790ecac

SHA512
498315539cc88c4517fa07d9106e3f8d38699ce9c8ecdd346c5f447f822fb234b26fc47611683b9f9e2c634cdc987eb6f9454814aeccd589f491bcd26e91edce

Download Submit
memory/4112-0-0x0000000000770000-0x0000000000795000-memory.dmp

Filesize
148KB

Download
memory/4112-3-0x0000000000770000-0x0000000000795000-memory.dmp

Filesize
148KB

Download
memory/4112-19-0x0000000000770000-0x0000000000795000-memory.dmp

Filesize
148KB

Download
memory/4984-13-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/4984-21-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/4984-23-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/4984-29-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download