urelas | 950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe
Size

69KB
MD5

bc946f6d60e45760691b1677a1be5332
SHA1

4a157f0f68a46e5a53d58a63c0afaa7b340e1f6c
SHA256

950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6
SHA512

eb97dbbff65bfd7cc069d00b9f5ab564a0c8998c53f785a2bddb9072e1390d6d9a08b862c21395b279834270353d6477fae5f9740c9c5669ec174f0a35a4fb25
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarawv:yLAYUzmdD0sMQl7d7IuhCaem

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2696 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

1744 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe

pid process

1520 950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2696	cmd.exe

pid	process
1744	biudfw.exe

pid	process
1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe

description	pid	process	target process
PID 1520 wrote to memory of 1744	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	biudfw.exe
PID 1520 wrote to memory of 1744	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	biudfw.exe
PID 1520 wrote to memory of 1744	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	biudfw.exe
PID 1520 wrote to memory of 1744	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	biudfw.exe
PID 1520 wrote to memory of 2696	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	cmd.exe
PID 1520 wrote to memory of 2696	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	cmd.exe
PID 1520 wrote to memory of 2696	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	cmd.exe
PID 1520 wrote to memory of 2696	1520	950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe
"C:\Users\Admin\AppData\Local\Temp\950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
ea8e3df0de86d7449fbaccc277815ad5

SHA1
1dfaaa9bb377d56786143050914e42a56ba3c7c2

SHA256
2b3b0ba862feaf839c0137d802df53e11db4fcb1887b0c868f32e1a5fbdc166c

SHA512
c3b3571cb1d009b487a402eadd44bcd6716e3287b754168a1602bbf6efe0c5b14dbf3244b3cb01b1e736079f9aa231bc0177073cd3587c55a923c9695629bcf3

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
bc946f6d60e45760691b1677a1be5332

SHA1
4a157f0f68a46e5a53d58a63c0afaa7b340e1f6c

SHA256
950622c2d41ddc08383c11b97869f76305d7bfd1bcf462b0478365ec756cf4a6

SHA512
eb97dbbff65bfd7cc069d00b9f5ab564a0c8998c53f785a2bddb9072e1390d6d9a08b862c21395b279834270353d6477fae5f9740c9c5669ec174f0a35a4fb25

Download Submit
memory/1520-0-0x0000000000B90000-0x0000000000BB7000-memory.dmp

Filesize
156KB

Download
memory/1520-6-0x0000000000540000-0x0000000000567000-memory.dmp

Filesize
156KB

Download
memory/1520-19-0x0000000000B90000-0x0000000000BB7000-memory.dmp

Filesize
156KB

Download
memory/1744-10-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download
memory/1744-22-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download
memory/1744-24-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download
memory/1744-31-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download