urelas | de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1

Analysis

max time kernel
136s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe
Size

66KB
MD5

3249d05491763fe671eb6158a8e7c1ce
SHA1

1256dd6f0ee7f5c35a9f025c2ef57e95260f578a
SHA256

de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1
SHA512

008e244778a4e6b61d455cdb2e65c65029a6afb05673a9640f9bb24ffb510e72814f87914402630b2ba8149595a7b1ec14951f1dfcd93054e60fff59a5fd4e04
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPZ:l//AjMp+u2onejH2PZ

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

4492 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4492	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe

description	pid	process	target process
PID 1924 wrote to memory of 4492	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	biudfw.exe
PID 1924 wrote to memory of 4492	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	biudfw.exe
PID 1924 wrote to memory of 4492	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	biudfw.exe
PID 1924 wrote to memory of 380	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	cmd.exe
PID 1924 wrote to memory of 380	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	cmd.exe
PID 1924 wrote to memory of 380	1924	de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe
"C:\Users\Admin\AppData\Local\Temp\de42e7e0382a534dfbf940e3217401485672d27554c46b08239d71c8df0aa5c1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
66KB

MD5
29935d529c707a9da8ed1be7c28dea58

SHA1
49f39c25f1f1bc5139d882ba5f448c95e2e14783

SHA256
a00f9d60402aa3eef3c3f51511904f6fde160f7fb7ac9c718cbf05885b4ac81f

SHA512
646e56efe294e6bb63624c5d5cadbf1d288724b6808672ad6a67c53f76a6dce9e6e7a680aed6dfc8f44ac023cbb9244184e7ec0d4bcb80f5ca561384d8b7f003

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
581c92539834f7e703633bda3011c72d

SHA1
e301bf0a2d466de27b8fa51d5cda8e4f6967a768

SHA256
4c93db9f5ee22cfa7016804bf800e0b4cc7bb2d4111a582d5f5e57ab91ed3996

SHA512
41351134f8b3f6b0a28e8960dee9b119cf4a04c7e3f63007501183d330385a452bbc2c87f4de38de2fe8c411bef31c8d8c4c8052361b030d133ab4b0e1d573ff

Download Submit
memory/1924-0-0x0000000000E90000-0x0000000000EB8000-memory.dmp

Filesize
160KB

Download
memory/1924-18-0x0000000000E90000-0x0000000000EB8000-memory.dmp

Filesize
160KB

Download
memory/4492-15-0x0000000000790000-0x00000000007B8000-memory.dmp

Filesize
160KB

Download
memory/4492-21-0x0000000000790000-0x00000000007B8000-memory.dmp

Filesize
160KB

Download
memory/4492-23-0x0000000000790000-0x00000000007B8000-memory.dmp

Filesize
160KB

Download
memory/4492-30-0x0000000000790000-0x00000000007B8000-memory.dmp

Filesize
160KB

Download