urelas | d6aa1906e2098acf10c24baf71e3b1e8c9ef2a2eb53c173535b8196003c600f5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe
Size

60KB
MD5

86edc4a25072fe283b12b22e40a93450
SHA1

625a059dc0898724ce917e6c9c7f2ca98a7aa2d4
SHA256

d6aa1906e2098acf10c24baf71e3b1e8c9ef2a2eb53c173535b8196003c600f5
SHA512

8b7b3619a6be763dc07b53a8650b2352290dfd86755e66cf75f58f937f869d2766e1cec17084494ee85792a7899ff9baf339744813628906238dec89510db103
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVI:Jo0cAthu6+FQ0JuPkI

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2120 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

1972 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

pid process

2392 86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2120	cmd.exe

pid	process
1972	biudfw.exe

pid	process
2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

description	pid	process	target process
PID 2392 wrote to memory of 1972	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 2392 wrote to memory of 1972	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 2392 wrote to memory of 1972	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 2392 wrote to memory of 1972	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 2392 wrote to memory of 2120	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe
PID 2392 wrote to memory of 2120	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe
PID 2392 wrote to memory of 2120	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe
PID 2392 wrote to memory of 2120	2392	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
304B

MD5
b974c68a421e285d730c2ad6bfef3a4b

SHA1
0553cfd110da7c4423ccd7e6eb1b38d4a2edc52e

SHA256
908893d8a4b7a8a7b99ea0bc6ad010bf3a3f096edf3d42f9d47a4386c45fdfe9

SHA512
1f1b4fa75ea8d8c86fc2706c94c43cad2381a4885140251485870ed9b40e4693e7dbb15b40d3c77ba779061f56ae3e1bbc35931029825edf696496cf25a11739

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
60KB

MD5
86edc4a25072fe283b12b22e40a93450

SHA1
625a059dc0898724ce917e6c9c7f2ca98a7aa2d4

SHA256
d6aa1906e2098acf10c24baf71e3b1e8c9ef2a2eb53c173535b8196003c600f5

SHA512
8b7b3619a6be763dc07b53a8650b2352290dfd86755e66cf75f58f937f869d2766e1cec17084494ee85792a7899ff9baf339744813628906238dec89510db103

Download Submit
memory/1972-11-0x0000000000D30000-0x0000000000D55000-memory.dmp

Filesize
148KB

Download
memory/1972-22-0x0000000000D30000-0x0000000000D55000-memory.dmp

Filesize
148KB

Download
memory/1972-24-0x0000000000D30000-0x0000000000D55000-memory.dmp

Filesize
148KB

Download
memory/1972-31-0x0000000000D30000-0x0000000000D55000-memory.dmp

Filesize
148KB

Download
memory/2392-0-0x0000000000220000-0x0000000000245000-memory.dmp

Filesize
148KB

Download
memory/2392-6-0x00000000002C0000-0x00000000002E5000-memory.dmp

Filesize
148KB

Download
memory/2392-19-0x0000000000220000-0x0000000000245000-memory.dmp

Filesize
148KB

Download