urelas | 94514f962d5548354d0e18ab4c25e85d759e024a2955bb0f8aaffd6519ec1d12

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe
Size

69KB
MD5

199b2e34de6cc3dde9b75f46977642ca
SHA1

d261ba4431921f083d52e9a607081dd95b47485d
SHA256

94514f962d5548354d0e18ab4c25e85d759e024a2955bb0f8aaffd6519ec1d12
SHA512

df87e3822eafe2b43052b073350801b3070317a5b221e5c9447bad35a008298f90a2d6309bb0f7d6f2c7fff20a04d015bd0ec7bcd7a11688bd550d6f75ef1562
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarA:yLAYUzmdD0sMQl7d7IuhCa8

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
3124	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3124	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	84
PID 3536 wrote to memory of 3124	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	84
PID 3536 wrote to memory of 3124	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	84
PID 3536 wrote to memory of 2256	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	85
PID 3536 wrote to memory of 2256	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	85
PID 3536 wrote to memory of 2256	3536	199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe	85

C:\Users\Admin\AppData\Local\Temp\199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\199b2e34de6cc3dde9b75f46977642ca_NEIKI.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
fc580dd022d63798cb3f5a03ee3fee25

SHA1
6832f139162b622c35e53b4e53728be8599b0770

SHA256
8e9c230edf5cafa96600f78a6046a3f5268adb0692bef9022b3b4f4d4545ab37

SHA512
1d9af2673db12f41532bb7e28f6e37b54505c4c45e8611b777778459003e45476f2fc9fd426b42b5e6e10957ab5cbed97bf6e4e37db2b8705aecca342f6b31ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
286B

MD5
f2bbbc8b8f138275d08aa47999b9db85

SHA1
85f3ef510bf263401e823f48354e88f868ad8dea

SHA256
123ddb576972453117b27d9e6a56b2afb27e93eb1af0deeca7cd659e81e6c251

SHA512
ed72239e4b9aa2ff8f40c72d9bc0053a5f573474017742d9c21fd0f8c0caacea09ac37f3e987a3f5e54e006104d9535e7ae72bc6ffebe6228f96ef0fd2f936f4

Download Submit
memory/3124-15-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/3124-21-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/3124-23-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/3124-29-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/3536-0-0x0000000000950000-0x0000000000977000-memory.dmp

Filesize
156KB

Download
memory/3536-18-0x0000000000950000-0x0000000000977000-memory.dmp

Filesize
156KB

Download