urelas | d6aa1906e2098acf10c24baf71e3b1e8c9ef2a2eb53c173535b8196003c600f5

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe
Size

60KB
MD5

86edc4a25072fe283b12b22e40a93450
SHA1

625a059dc0898724ce917e6c9c7f2ca98a7aa2d4
SHA256

d6aa1906e2098acf10c24baf71e3b1e8c9ef2a2eb53c173535b8196003c600f5
SHA512

8b7b3619a6be763dc07b53a8650b2352290dfd86755e66cf75f58f937f869d2766e1cec17084494ee85792a7899ff9baf339744813628906238dec89510db103
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVI:Jo0cAthu6+FQ0JuPkI

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

3340 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3340	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe

description	pid	process	target process
PID 1532 wrote to memory of 3340	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 1532 wrote to memory of 3340	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 1532 wrote to memory of 3340	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	biudfw.exe
PID 1532 wrote to memory of 452	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe
PID 1532 wrote to memory of 452	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe
PID 1532 wrote to memory of 452	1532	86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86edc4a25072fe283b12b22e40a93450_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:3340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
60KB

MD5
1853d5d6cd50d9ebe57b501244aa7ec4

SHA1
424115d8afe8e868f9aedcd5e540eaae5197a1e1

SHA256
b358d63a6be2672dab4419dafe46fd3efcd345ebad79b1dc12e81076c21d0ab7

SHA512
5074ab3cdc8553680ecfd01d41587a71e7413a6b702b9629bfeac18d3a29a831cd0253cbe8f48e6bc3b6b842ea3f6a827fbc412d9919dac3a521aca8f96cc316

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
304B

MD5
b974c68a421e285d730c2ad6bfef3a4b

SHA1
0553cfd110da7c4423ccd7e6eb1b38d4a2edc52e

SHA256
908893d8a4b7a8a7b99ea0bc6ad010bf3a3f096edf3d42f9d47a4386c45fdfe9

SHA512
1f1b4fa75ea8d8c86fc2706c94c43cad2381a4885140251485870ed9b40e4693e7dbb15b40d3c77ba779061f56ae3e1bbc35931029825edf696496cf25a11739

Download Submit
memory/1532-0-0x0000000000D00000-0x0000000000D25000-memory.dmp

Filesize
148KB

Download
memory/1532-17-0x0000000000D00000-0x0000000000D25000-memory.dmp

Filesize
148KB

Download
memory/3340-15-0x00000000006A0000-0x00000000006C5000-memory.dmp

Filesize
148KB

Download
memory/3340-20-0x00000000006A0000-0x00000000006C5000-memory.dmp

Filesize
148KB

Download
memory/3340-22-0x00000000006A0000-0x00000000006C5000-memory.dmp

Filesize
148KB

Download
memory/3340-28-0x00000000006A0000-0x00000000006C5000-memory.dmp

Filesize
148KB

Download