urelas | 7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504

General

Target

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
Size

6.7MB
MD5

2017c8bca8ff7fd3d3fe986e50b93139
SHA1

03c80dbc6ebf3dcb888c9c56055d0779b0719017
SHA256

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504
SHA512

52c648bb4e40b3d6f4c76382ecbf4ae2692f34da00f1e62d2e3404ba40bc7aad5a188f67b34f4de1a41341fed059c5dff8fbd870532f0bd955ecf4ef2dc985bb
SSDEEP

196608:b9GWRCGhftfdjM49RncR54SEMgPAU4EXWlz:5vLDfdjM4TyhrgPFf6

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

3940 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3940	biudfw.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exebiudfw.exe

pid	process
452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
3940	biudfw.exe
3940	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe

description	pid	process	target process
PID 452 wrote to memory of 3940	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	biudfw.exe
PID 452 wrote to memory of 3940	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	biudfw.exe
PID 452 wrote to memory of 3940	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	biudfw.exe
PID 452 wrote to memory of 3200	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	cmd.exe
PID 452 wrote to memory of 3200	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	cmd.exe
PID 452 wrote to memory of 3200	452	7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe
"C:\Users\Admin\AppData\Local\Temp\7cb0e0a8b51aed6360042dc9a637a317be1a35906c451712616db944e1eb7504.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
6.7MB

MD5
3759cac61e95ade840809a7609c73430

SHA1
c958a973d186bcffec3bdafdc178a26aab47456a

SHA256
ca9280db56f48efcb4308b7540538a6181f8c7d38543619825338def8084cc2b

SHA512
37b53d1b4c672006c58d06a0026ab66ce0dea7ca307d17f1fcbf075e92b3a7f08fb2e7fb7bc857eae40cac648083250971cdb3adb6ac813be55d10d7491afee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
d021bfa58d7228af17d5bcef395d4edd

SHA1
142264de91c8b5adeb5782f1d51c98cc98df9726

SHA256
52e6f0e628520b8721fdeef525f8c371a914bd24820d7afe93f157bc269e35cd

SHA512
a4c8d6ee79c4f21b980b2d0a890c8061ac2fbdec89a449d632ea6a9bc9a6f43d6c69489d52a9b8a587dc18484fe2785be51a807122c2e71b0130798635300182

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
338B

MD5
55d66cded390bd757e77e6bb5e39073b

SHA1
825bbefbbe5bdf13fb30f088cefa603a06608747

SHA256
b7dbf1a1483d7b729b1fe69368aeaedb9f097ca4387c82a2c43ba99142db11ca

SHA512
05b76d29bd1e58a92512f48ddd3f6363f5be79a2f2a70684c6af3a90ff910b4b8f20ea403dab662ba95c029de35980b2fe18594641ffb24da24fac3e5143800e

Download Submit
memory/452-29-0x0000000000C46000-0x0000000001005000-memory.dmp

Filesize
3.7MB

Download
memory/452-6-0x0000000001750000-0x0000000001751000-memory.dmp

Filesize
4KB

Download
memory/452-9-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/452-8-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/452-10-0x0000000000C10000-0x00000000016B6000-memory.dmp

Filesize
10.6MB

Download
memory/452-7-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/452-5-0x0000000001720000-0x0000000001721000-memory.dmp

Filesize
4KB

Download
memory/452-4-0x0000000001710000-0x0000000001711000-memory.dmp

Filesize
4KB

Download
memory/452-3-0x0000000001700000-0x0000000001701000-memory.dmp

Filesize
4KB

Download
memory/452-1-0x0000000000C46000-0x0000000001005000-memory.dmp

Filesize
3.7MB

Download
memory/452-28-0x0000000000C10000-0x00000000016B6000-memory.dmp

Filesize
10.6MB

Download
memory/452-0-0x0000000000C10000-0x00000000016B6000-memory.dmp

Filesize
10.6MB

Download
memory/452-2-0x0000000000C10000-0x00000000016B6000-memory.dmp

Filesize
10.6MB

Download
memory/3940-38-0x0000000001750000-0x0000000001751000-memory.dmp

Filesize
4KB

Download
memory/3940-37-0x0000000001730000-0x0000000001731000-memory.dmp

Filesize
4KB

Download
memory/3940-39-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download
memory/3940-41-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download
memory/3940-36-0x0000000001720000-0x0000000001721000-memory.dmp

Filesize
4KB

Download
memory/3940-34-0x00000000016E0000-0x00000000016E1000-memory.dmp

Filesize
4KB

Download
memory/3940-35-0x0000000001710000-0x0000000001711000-memory.dmp

Filesize
4KB

Download
memory/3940-33-0x00000000016C0000-0x00000000016C1000-memory.dmp

Filesize
4KB

Download
memory/3940-31-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download
memory/3940-32-0x00000000016B0000-0x00000000016B1000-memory.dmp

Filesize
4KB

Download
memory/3940-27-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download
memory/3940-43-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download
memory/3940-44-0x00000000006B0000-0x0000000001156000-memory.dmp

Filesize
10.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads