urelas | 94514f962d5548354d0e18ab4c25e85d759e024a2955bb0f8aaffd6519ec1d12

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe
Size

69KB
MD5

199b2e34de6cc3dde9b75f46977642ca
SHA1

d261ba4431921f083d52e9a607081dd95b47485d
SHA256

94514f962d5548354d0e18ab4c25e85d759e024a2955bb0f8aaffd6519ec1d12
SHA512

df87e3822eafe2b43052b073350801b3070317a5b221e5c9447bad35a008298f90a2d6309bb0f7d6f2c7fff20a04d015bd0ec7bcd7a11688bd550d6f75ef1562
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarA:yLAYUzmdD0sMQl7d7IuhCa8

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3056	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	28
PID 1968 wrote to memory of 3056	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	28
PID 1968 wrote to memory of 3056	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	28
PID 1968 wrote to memory of 3056	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	28
PID 1968 wrote to memory of 2664	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	29
PID 1968 wrote to memory of 2664	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	29
PID 1968 wrote to memory of 2664	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	29
PID 1968 wrote to memory of 2664	1968	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
286B

MD5
f2bbbc8b8f138275d08aa47999b9db85

SHA1
85f3ef510bf263401e823f48354e88f868ad8dea

SHA256
123ddb576972453117b27d9e6a56b2afb27e93eb1af0deeca7cd659e81e6c251

SHA512
ed72239e4b9aa2ff8f40c72d9bc0053a5f573474017742d9c21fd0f8c0caacea09ac37f3e987a3f5e54e006104d9535e7ae72bc6ffebe6228f96ef0fd2f936f4

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
c9cca0a89f5aaea25969e2b92cc003bb

SHA1
9dbf27a18e3ae091a8dcc8bd90b6a16ec0bf690f

SHA256
b5f754ad196a284b8d81ca55b1c6ce7c122bfd196e0546d0015d3394a5811e6c

SHA512
fdb11e394ff48273b94f5fce7e74e6d232b2be0110ea95c67c59756f3dcd619a3bd42b09dd516e0970422f6c684c35e82680912ac85b06be11c9d31cdc253b98

Download Submit
memory/1968-0-0x00000000013D0000-0x00000000013F7000-memory.dmp

Filesize
156KB

Download
memory/1968-9-0x0000000000990000-0x00000000009B7000-memory.dmp

Filesize
156KB

Download
memory/1968-19-0x00000000013D0000-0x00000000013F7000-memory.dmp

Filesize
156KB

Download
memory/3056-11-0x0000000001160000-0x0000000001187000-memory.dmp

Filesize
156KB

Download
memory/3056-22-0x0000000001160000-0x0000000001187000-memory.dmp

Filesize
156KB

Download
memory/3056-24-0x0000000001160000-0x0000000001187000-memory.dmp

Filesize
156KB

Download
memory/3056-30-0x0000000001160000-0x0000000001187000-memory.dmp

Filesize
156KB

Download