urelas | 3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe
Size

55KB
MD5

a585eab913c2d30588ced7befc223f10
SHA1

a531a8cea3a625d5fbdad4d7181417cb2cd15737
SHA256

3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90
SHA512

12eea91eeb219a9e061b5907ac9979cab90fc860eacb3aeef5fba8665efbf2d820b7593f871a193b7f393a82c1a773c8875a1f8213be86ac4de725e2c1768f9d
SSDEEP

1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrgHq:vMhAe5Zs091KI+JYixw49XjrX

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

5116 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5116	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe

description	pid	process	target process
PID 940 wrote to memory of 5116	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	biudfw.exe
PID 940 wrote to memory of 5116	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	biudfw.exe
PID 940 wrote to memory of 5116	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	biudfw.exe
PID 940 wrote to memory of 4560	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	cmd.exe
PID 940 wrote to memory of 4560	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	cmd.exe
PID 940 wrote to memory of 4560	940	3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c4f7f5a6596bc789017f50ee0422e12c0bc08a211377929420b42e586f1ec90_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
55KB

MD5
3c111ee69c9cf0670f51eb7ee5e6fe0e

SHA1
2290b9adf8815687e2f3483ba3fb27b3328bbf27

SHA256
10000051e004daf55e34b8c26f42766aaef9d408c369515ffac405dbc9e2c1a7

SHA512
26d595534e430cd5c6aa8b8d8b7f2afecd9a0070d996523d6e0f4deb2153b3a1e8344d70b743f4e91d22e5674119d14fa18907ba719ed0d9248281c4ce0d372a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
b4a86880004da8726288d7ec954885a8

SHA1
1bab1cfbdc2c540246210bc7852f8fe7e8357b31

SHA256
c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46

SHA512
22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
368B

MD5
9fbf0efb38d20fa597c3e5ab08833606

SHA1
7e15caf4c7bd5af924b9e9ff1b03c862424622a7

SHA256
f2691316e55611e11bcd55b279ed664e9f4f874a0c8d6c53f841562db70c8597

SHA512
fd2b5d79cd7da33f320ed1ec2ee0ad349651a3a7c95fff2e4eafef89f20cc505a64e5768ea09e6e1409e1d0912b4dfc7072960b8a97a217855f41789bda1dcc2

Download Submit
memory/940-0-0x00000000009C0000-0x00000000009E6000-memory.dmp

Filesize
152KB

Download
memory/940-15-0x00000000009C0000-0x00000000009E6000-memory.dmp

Filesize
152KB

Download
memory/5116-12-0x0000000000EB0000-0x0000000000ED6000-memory.dmp

Filesize
152KB

Download
memory/5116-18-0x0000000000EB0000-0x0000000000ED6000-memory.dmp

Filesize
152KB

Download
memory/5116-20-0x0000000000EB0000-0x0000000000ED6000-memory.dmp

Filesize
152KB

Download
memory/5116-27-0x0000000000EB0000-0x0000000000ED6000-memory.dmp

Filesize
152KB

Download