urelas | d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16

Analysis

max time kernel
138s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe
Size

113KB
MD5

ff10385250e75dd03e1d52b24afe366f
SHA1

117feb2ae62db3e9bb9d9a21d2e8cf54df9d832c
SHA256

d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16
SHA512

dfbddb01628eabd718795cbc4709e7d894021490def8f90e0cfa52594c371714fa451ee40dad87f2cb5d63b526402a9b04342882d2dd81f780221806da4ab433
SSDEEP

1536:mCnrJLwAXDtIBcUyk+8CooNvy3GNbcq7+sWjcdgy64TNSeb:htpCP+/oGvWSldgy64TNSeb

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

3404 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3404	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe

description	pid	process	target process
PID 1592 wrote to memory of 3404	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	biudfw.exe
PID 1592 wrote to memory of 3404	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	biudfw.exe
PID 1592 wrote to memory of 3404	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	biudfw.exe
PID 1592 wrote to memory of 2120	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	cmd.exe
PID 1592 wrote to memory of 2120	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	cmd.exe
PID 1592 wrote to memory of 2120	1592	d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe
"C:\Users\Admin\AppData\Local\Temp\d5c79880d6c7618cbc1ea237cd79d7871fd1f4a5730a56ba98415fe6c7e2eb16.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
113KB

MD5
b91bc298673f16fcc7148db3ec8c9456

SHA1
4f4c1a51adc620c34bd94d71f60f48c389420b25

SHA256
792e8526596594d7ffef17d6e4573a6c4c62e7b8a791a73fa6be8c748a2102b2

SHA512
f303c571e975e1493143595a872a653a63242b46e6e9ca4db1e2e163c819f1dddd7a49eee1cda8ab9bd33c135b3afd59600026688b0ef21d461647fa4d6b16af

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f0d42f2e44d35f66afa6c7a98d053021

SHA1
f874284acb7ed4b80e2733ed4f66656bd2c5447d

SHA256
d2060822260cd38f5fc68b1f3b9f9b787b250e1a9fa417be79cdc692ca066f8d

SHA512
d5b9a5e504276623574ba2c16e6d305c86b20ff3e6353dbe251e04287583c27d825fddfe4325530c249cc95ddd3e0674c86acdf2e7f4bd3c3404eab51c022a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
2d1a47bf73082e7639fb5217367ed5e4

SHA1
0a8e244cc7969df1d79aed3d5674da4e2f000961

SHA256
c5c0271d7c1fe0ff8f08cbd67d1e08746c84e6504e8f9f6d4b10e0a90d023a74

SHA512
3a38b71091fb890a3c56fcc48cf84143ea8737dd24c493b473da4cdfff96db3bbacfb9752388fa52fb8cc6aee1edc0170f84dd9afcf30f8d0bf2e99c7b694de0

Download Submit
memory/1592-0-0x0000000000F80000-0x0000000000FA7000-memory.dmp

Filesize
156KB

Download
memory/1592-19-0x0000000000F80000-0x0000000000FA7000-memory.dmp

Filesize
156KB

Download
memory/3404-13-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download
memory/3404-20-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download