urelas | 1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe
Size

63KB
MD5

7d0a40fe50894a8d68e6c6a58ff61d80
SHA1

47b5d41a4f4cd69315fd2fa2dbfd5ea82abf737d
SHA256

1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64
SHA512

672e6125f926c305f8b177a3fb04c73828d79995d4ebf97a2200498d7f8469bfdbccbeddb20f34b680a3793c1e244be5cb1bfad17beaf367dec1e58e177f4f07
SSDEEP

1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTmUDG+:6bQRSHpAvzyf7MzeThDG+

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

1420 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1420	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe

description	pid	process	target process
PID 1876 wrote to memory of 1420	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	biudfw.exe
PID 1876 wrote to memory of 1420	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	biudfw.exe
PID 1876 wrote to memory of 1420	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	biudfw.exe
PID 1876 wrote to memory of 2376	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	cmd.exe
PID 1876 wrote to memory of 2376	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	cmd.exe
PID 1876 wrote to memory of 2376	1876	1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1c6e3ab91a32a0936e8754bcb7448a969946435ff5a30e416ea2a42875b23d64_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:1420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:2376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
63KB

MD5
cf1cc643bc2c9fe915f38d892e2bcf45

SHA1
304ae6be5b0ee142983ee85fffa8770bbb20cab7

SHA256
03b41c988769cdfaf9f1bc4df502e4b03f0640bf03e30babb6092eacf3b07bf1

SHA512
80a8ecc38aa396fbb731a598559c7b7d861160eaf90f7e13916a45cea6a93aa51a85fcae0dd8277449759c4b49108b19b1fc042e72fba3885fa2c3d1e112e5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
efd90b3ac908d5482af367de3a82184a

SHA1
de9f01d2ed0247b7b347e55c5a09721a60147fb9

SHA256
44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d

SHA512
6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
368B

MD5
f648aa0aa40198be11bd5667016ab19b

SHA1
6498801f406a5c71f8cdb7e524f54bbefda90681

SHA256
0a47c039d1e4a1fabc259754d615b0eb4b53e13d0001d4636e73db9b4d1c356e

SHA512
af97dd94b880b76fafa0387bb2ea80e15fc424ce923071bb84ecfeb75f60157d3b72e89f9202618bcef806ae7fb9be840f9c3d6e47967d91f6f1f1bf29a42456

Download Submit
memory/1420-15-0x00000000004D0000-0x00000000004F5000-memory.dmp

Filesize
148KB

Download
memory/1420-20-0x00000000004D0000-0x00000000004F5000-memory.dmp

Filesize
148KB

Download
memory/1420-22-0x00000000004D0000-0x00000000004F5000-memory.dmp

Filesize
148KB

Download
memory/1420-28-0x00000000004D0000-0x00000000004F5000-memory.dmp

Filesize
148KB

Download
memory/1876-0-0x0000000000FE0000-0x0000000001005000-memory.dmp

Filesize
148KB

Download
memory/1876-17-0x0000000000FE0000-0x0000000001005000-memory.dmp

Filesize
148KB

Download