urelas | 8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 23:48

Target

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe
Size

154KB
MD5

0aae3d12c5866fb90e7841f3b64c1bfb
SHA1

f8f472d74b5c6ca4515630dc268d31f5ed0fc052
SHA256

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d
SHA512

794fc048cbe0fe2f2565706bd33fed1a4c9f93a91833c32eb77bdf912435a50c8d9c3f0aad4c4c8a0e635a7731bc9a9b7da056c1aefcfd63cbed3719e4ec42fb
SSDEEP

3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2Oeu:Nt2vsx+AV4LfLOl

Score

10^/10

urelas trojan

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2632 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2496 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

pid process

2724 8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2632	cmd.exe

pid	process
2496	biudfw.exe

pid	process
2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

description	pid	process	target process
PID 2724 wrote to memory of 2496	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 2724 wrote to memory of 2496	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 2724 wrote to memory of 2496	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 2724 wrote to memory of 2496	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 2724 wrote to memory of 2632	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe
PID 2724 wrote to memory of 2632	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe
PID 2724 wrote to memory of 2632	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe
PID 2724 wrote to memory of 2632	2724	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2496

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2930c042c9ee5e07f321f2134a0c7edc

SHA1
ee39f41eaf6ce3c8d917a89e65959414ae0088e6

SHA256
a328475bbb730da292b83ed6cabbdbfc0616f042296f0c6fa356c5368ffc1309

SHA512
2da91d5effc116d8c8661c2a99f1d9c2aaffda0f776551dc7ad1911fdb2765591e5b441b9a1fe0090bcda8ed24d180b563ed2c127676cf1de40001e4b15b5506

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
1da09de2f3d27b08d838d54386f25ea6

SHA1
32f77dc23c21d2e657c6d088272bfd75676e411a

SHA256
c68ac859fb556f76a4b0ff68b3c5251f993acc99b38a847f369d62a3e42f640a

SHA512
51a8bc35d63a39f101649d9e531fd749bde3aceb501364d0f9cbc8cdb013452f1d5fc6343bd26ab8cd76e9f4016de7be7ffce3ba374692597f61781b395d3e28

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
154KB

MD5
2b34ff3ee8db9e24f24b7aecbd20d751

SHA1
29d66616f872f72f8dd768dd0dfc4bd2096069d5

SHA256
82ad89cd21250953475e2552a3a211e85e3910a415ea555231aff4a4873c75cc

SHA512
8c7153a61a862e1b353fa8ca690b8d7ba819e1fdceef276eb53c752edad6ef0d061e3376b6a8202918902da27ed0d883a60776089107dffe16b7872fb6d2b78a

Download Submit