urelas | 615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe
Size

69KB
MD5

0c627bf8a135bd27c4cb684f6cf04ca9
SHA1

80b5caed48062fb4c450850db031ad90f1bc6a97
SHA256

615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd
SHA512

d7dd7df68107486712fe2241c25c469c81687c8ce3a6ce7ee8d4dfc6b8cb01b04663e1a5213f50b306057b0364a993c4bb3fb9e62e50f4d08b7e3d9ef918e65d
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarawU:yLAYUzmdD0sMQl7d7IuhCaeX

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1204 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

1644 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe

pid process

2740 615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1204	cmd.exe

pid	process
1644	biudfw.exe

pid	process
2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe

description	pid	process	target process
PID 2740 wrote to memory of 1644	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	biudfw.exe
PID 2740 wrote to memory of 1644	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	biudfw.exe
PID 2740 wrote to memory of 1644	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	biudfw.exe
PID 2740 wrote to memory of 1644	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	biudfw.exe
PID 2740 wrote to memory of 1204	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	cmd.exe
PID 2740 wrote to memory of 1204	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	cmd.exe
PID 2740 wrote to memory of 1204	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	cmd.exe
PID 2740 wrote to memory of 1204	2740	615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe
"C:\Users\Admin\AppData\Local\Temp\615e8c64728f8a5431988130a77406b9ae579e78a8552a9be642fb20d28953bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
516bb5da3574bcba4851be32c5292faa

SHA1
4a816bb6c316b7deea8a09bcdd8e0aa9941b23eb

SHA256
e16e238ea6538ea6bcc6871968076f18e934a727ce0aa90dfa760126bfabcc91

SHA512
a5234a3aac3fad7d8b8e90e383a494cbb390a94060fa73c62801c0d96edd11f11a814b8409ece2404d44c2cdaa912d929e2855971aca5f6b8986356c726f8354

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
1d43cbcc5a9c2138c18c9016fd92a727

SHA1
723698a9d98bca774981c26381de58f61d3016b9

SHA256
b60fe687ba7a3d11503145fae54ab1ca72f206eeb14841af534f3307e28c23cd

SHA512
01475bc1da7e0fb2c191d412d32a671a12d64ab1642694f2ef74492eadeb82a545a88653166f513582f76cbdce385f4fabd40facd75504eda4b5a68c3a56d847

Download Submit
memory/1644-10-0x00000000011B0000-0x00000000011D7000-memory.dmp

Filesize
156KB

Download
memory/1644-22-0x00000000011B0000-0x00000000011D7000-memory.dmp

Filesize
156KB

Download
memory/1644-24-0x00000000011B0000-0x00000000011D7000-memory.dmp

Filesize
156KB

Download
memory/1644-31-0x00000000011B0000-0x00000000011D7000-memory.dmp

Filesize
156KB

Download
memory/2740-0-0x0000000001070000-0x0000000001097000-memory.dmp

Filesize
156KB

Download
memory/2740-5-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/2740-19-0x0000000001070000-0x0000000001097000-memory.dmp

Filesize
156KB

Download