urelas | 2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe
Size

159KB
MD5

b6bc1f927a099e8a5092dc71f346d620
SHA1

261c1a4ad4ab811628b9a96d6051cc923b74083e
SHA256

2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432
SHA512

04584d2d68815354a4287d673294c99ee27404e19ed835fae205174c5f278f1f7649e07bf17e0590711668c9cee14e2ea79406c1b07c4d469846a9dc82f0c4f6
SSDEEP

1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcDp:nVlUPZRxfxE9Vs5cfdd6YGGIF

Score

10^/10

urelas trojan

Malware Config

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2668	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2468	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2468	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	28
PID 1952 wrote to memory of 2468	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	28
PID 1952 wrote to memory of 2468	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	28
PID 1952 wrote to memory of 2468	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	28
PID 1952 wrote to memory of 2668	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	29
PID 1952 wrote to memory of 2668	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	29
PID 1952 wrote to memory of 2668	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	29
PID 1952 wrote to memory of 2668	1952	b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
159KB

MD5
b6bc1f927a099e8a5092dc71f346d620

SHA1
261c1a4ad4ab811628b9a96d6051cc923b74083e

SHA256
2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432

SHA512
04584d2d68815354a4287d673294c99ee27404e19ed835fae205174c5f278f1f7649e07bf17e0590711668c9cee14e2ea79406c1b07c4d469846a9dc82f0c4f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
286B

MD5
40b13f0286f3458c05288653db628d71

SHA1
c4cd9ed6086ad518f45aa3ee4e1b406c2e38bc47

SHA256
e0f361aa04d9680e76035e631d8762094379d454ce4882c7a234e146a1152cbf

SHA512
f156b6775b8410ad628607c253f5ec138f73ab708d7fc37cafa2191806ee27ea50bc6f8aa4519659cc6abc7689801607229d178b3094f795f4cc855ed89f3d95

Download Submit