urelas | 7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe
Size

6.7MB
MD5

2017c8bca8ff7fd3d3fe986e50b93139
SHA1

03c80dbc6ebf3dcb888c9c56055d0779b0719017
SHA256

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504
SHA512

52c648bb4e40b3d6f4c76382ecbf4ae2692f34da00f1e62d2e3404ba40bc7aad5a188f67b34f4de1a41341fed059c5dff8fbd870532f0bd955ecf4ef2dc985bb
SSDEEP

196608:b9GWRCGhftfdjM49RncR54SEMgPAU4EXWlz:5vLDfdjM4TyhrgPFf6

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2732 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe

pid process

1732 SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exebiudfw.exe

pid process

1732 SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe
2732 biudfw.exe

pid	process
2732	biudfw.exe

pid	process
1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe

pid	process
1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe
2732	biudfw.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe

description	pid	process	target process
PID 1732 wrote to memory of 2732	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	biudfw.exe
PID 1732 wrote to memory of 2732	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	biudfw.exe
PID 1732 wrote to memory of 2732	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	biudfw.exe
PID 1732 wrote to memory of 2732	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	biudfw.exe
PID 1732 wrote to memory of 2496	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	cmd.exe
PID 1732 wrote to memory of 2496	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	cmd.exe
PID 1732 wrote to memory of 2496	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	cmd.exe
PID 1732 wrote to memory of 2496	1732	SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop27.23534.8399.1150.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
d021bfa58d7228af17d5bcef395d4edd

SHA1
142264de91c8b5adeb5782f1d51c98cc98df9726

SHA256
52e6f0e628520b8721fdeef525f8c371a914bd24820d7afe93f157bc269e35cd

SHA512
a4c8d6ee79c4f21b980b2d0a890c8061ac2fbdec89a449d632ea6a9bc9a6f43d6c69489d52a9b8a587dc18484fe2785be51a807122c2e71b0130798635300182

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
308B

MD5
505ce6529620df3920de9ff9fd80a718

SHA1
4ec111aa4995c2eb8212f5c86f1ca47c387acf6d

SHA256
553fcb0563b6621d06e93f16aad5a706253abd1ad38cd2bb898b84d60b6abc2b

SHA512
0f125533facbd92e30e9162161f852caa68ec4485a867c81d9eff6712c520dc70e93b2d69b08a924ddc75c79785b5b9f05f2a3a7b8853539657f9bbc38d7df5d

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
6.7MB

MD5
8a0429eddaf5fd5f30255d86f32afc38

SHA1
9ea3dca996e2dec49872190debd012c7665bb0eb

SHA256
c28644f30bbc017227b57ce7b1479941ffe92c69c31399b26804e1cf2b510199

SHA512
6d03ff28f99e78176847785acbd880e899d74e75187cea77fdca97115a51d68b24866d69243dbcebad87a5085ec3246566aa38048a4a79abf471e7b1fc49f067

Download Submit
memory/1732-1-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1732-11-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1732-35-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1732-33-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1732-30-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1732-25-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1732-36-0x0000000000E50000-0x00000000018F6000-memory.dmp

Filesize
10.6MB

Download
memory/1732-20-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1732-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1732-15-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1732-13-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1732-28-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1732-10-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1732-8-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1732-6-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1732-5-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1732-3-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1732-48-0x0000000004870000-0x0000000005316000-memory.dmp

Filesize
10.6MB

Download
memory/1732-23-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1732-39-0x0000000000E50000-0x00000000018F6000-memory.dmp

Filesize
10.6MB

Download
memory/1732-0-0x0000000000E50000-0x00000000018F6000-memory.dmp

Filesize
10.6MB

Download
memory/1732-38-0x0000000000E86000-0x0000000001245000-memory.dmp

Filesize
3.7MB

Download
memory/1732-59-0x0000000000E86000-0x0000000001245000-memory.dmp

Filesize
3.7MB

Download
memory/1732-58-0x0000000000E50000-0x00000000018F6000-memory.dmp

Filesize
10.6MB

Download
memory/2732-61-0x0000000001316000-0x00000000016D5000-memory.dmp

Filesize
3.7MB

Download
memory/2732-99-0x00000000012E0000-0x0000000001D86000-memory.dmp

Filesize
10.6MB

Download
memory/2732-81-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2732-79-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2732-76-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2732-74-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2732-71-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2732-69-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2732-66-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2732-64-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2732-57-0x00000000012E0000-0x0000000001D86000-memory.dmp

Filesize
10.6MB

Download
memory/2732-86-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2732-101-0x00000000012E0000-0x0000000001D86000-memory.dmp

Filesize
10.6MB

Download
memory/2732-102-0x0000000001316000-0x00000000016D5000-memory.dmp

Filesize
3.7MB

Download
memory/2732-103-0x0000000001316000-0x00000000016D5000-memory.dmp

Filesize
3.7MB

Download
memory/2732-104-0x00000000012E0000-0x0000000001D86000-memory.dmp

Filesize
10.6MB

Download