urelas | 9b3abf23e50f883b344343c9e58a721552f54f3f318ca1d724388e3d4813de0b

Analysis

max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
486b1dc06613fd4f6b3416b397f63950N.exe
Size 64KB
Sample240721-cewp7avbmj
SHA256 9b3abf23e50f883b344343c9e58a721552f54f3f318ca1d724388e3d4813de0b
MD5 486b1dc06613fd4f6b3416b397f63950
SHA1 b3c59f818d9849ec3c5f7edf4d9f35d88097eece
SHA512 d6fc304cea741180142a5b347c9202afa861e3231ba15224363ceac314c55657a31a77d56ca40d17c66fc147c9f60de2d11aab6fe48e6177285d0695032df33c
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTmUDY:6bQRSHpAvzyf7MzeThDY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	486b1dc06613fd4f6b3416b397f63950N.exe

Executes dropped EXE 1 IoCs

pid	Process
4424	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4424	1272	486b1dc06613fd4f6b3416b397f63950N.exe	89
PID 1272 wrote to memory of 4424	1272	486b1dc06613fd4f6b3416b397f63950N.exe	89
PID 1272 wrote to memory of 4424	1272	486b1dc06613fd4f6b3416b397f63950N.exe	89
PID 1272 wrote to memory of 2816	1272	486b1dc06613fd4f6b3416b397f63950N.exe	90
PID 1272 wrote to memory of 2816	1272	486b1dc06613fd4f6b3416b397f63950N.exe	90
PID 1272 wrote to memory of 2816	1272	486b1dc06613fd4f6b3416b397f63950N.exe	90

C:\Users\Admin\AppData\Local\Temp\486b1dc06613fd4f6b3416b397f63950N.exe
"C:\Users\Admin\AppData\Local\Temp\486b1dc06613fd4f6b3416b397f63950N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 64KB
SHA256 ab07c07b69c455f41985efac36bbbb33b43b3fbc4bec2c170c25321c46e98289
MD5 1c9d914ea0177948835aaadacdbc379b
SHA1 72dd1bc69f54bcec67feed7f622fcabce9b0ae16
SHA512 bd042be3b0533e50ed4f4b4540dfe682941c6b4daaff489d83ca7fa08546574b58a4e849949632f3331fdaae7e7a4fd54009cbfa57d2433a4069ff4408b6030c
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTmUDu:6bQRSHpAvzyf7MzeThDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
MD5 efd90b3ac908d5482af367de3a82184a
SHA1 de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA512 6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 276B
SHA256 e489504fee42fff9eb072ecdd5ec9c0d09e9740b073023002cc08603759cdeea
MD5 aa686ff8753243bc852d7551cc559b08
SHA1 2046603fa39ab1b7e0bee28b6f5191e5f3eacf71
SHA512 fffaa662cf0880ae7993ba2e2477a9cf8d268dafbe192c74c4c6fc66d0fa29b086091ae603db658b19d6284feabd98306ee50acfac58637f5c355f312c8172bf
MD5 SHA1 SHA512

Submit Download

memory/1272-0-0x00000000007E0000-0x0000000000805000-memory.dmp

Download

memory/1272-18-0x00000000007E0000-0x0000000000805000-memory.dmp

Download

memory/4424-15-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download

memory/4424-21-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download

memory/4424-23-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download

memory/4424-30-0x0000000000F30000-0x0000000000F55000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads