urelas | 96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe
Size 61KB
Sample240723-awa4psxbpd
SHA256 96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193
MD5 7656326bfa0425ed1af91346ef7e8145
SHA1 129977c7d8ccaf97256965dd16b595e323591325
SHA512 3b1408d715686fa020a92fb608bec20e44d9f1fac7c122c95ea419a4e8a7bb1925474b2c2dbea0d3d9fa9831d3c0bf6a18ec8ae903a8bf227b50287a83820a71
SSDEEP 1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVX:Jo0cAthu6+FQ0JuPkX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe

Executes dropped EXE 1 IoCs

pid	Process
3836	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3836	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	88
PID 3412 wrote to memory of 3836	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	88
PID 3412 wrote to memory of 3836	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	88
PID 3412 wrote to memory of 4612	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	89
PID 3412 wrote to memory of 4612	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	89
PID 3412 wrote to memory of 4612	3412	96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe	89

C:\Users\Admin\AppData\Local\Temp\96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe
"C:\Users\Admin\AppData\Local\Temp\96b8e39231c12d14a374177e0dc93f07c09189e6a492cfff504017b389fa9193.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 61KB
SHA256 fbd9fa2bbd322fc5ec4ed3a8515b0e0070511a2280b5fee03632be4c55791e9d
MD5 142f5f17f641281e29f0298267ce2f32
SHA1 2b3c7028247b5172d0cc6d3cde1ea7c33312e6d1
SHA512 8594c3eac8ce07e4ea82481f487b24cf9d63b282677f888d66b81aa18b61b0fb6877a5c576469f41f339fc2da8a0a2b94e0ad9205055052de6be7fceb4f2f678
SSDEEP 1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVu:Jo0cAthu6+FQ0JuPku
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472
MD5 657ce9e5dd337971e44dfb9cb3fbf7dd
SHA1 026734083afaa4b7d298781b26a72ac9b67ac831
SHA512 79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 c8c8298d8842e24e9ab1d2cc9f0fc17b37aff77cab537bc20ec6a1f087da4d74
MD5 7da2fbd9c5ddce1d380b73678a435e7c
SHA1 20953f7aa10d10786045d443138f1c1b0ac37821
SHA512 95f5ce671bb4814f7344eca71a83d6686d38a3fd7509cd338ece5f2a47f7b1e8c75f6e31c251ca7b31c4064328812f5d3a32ac273cd7f7e00871b8e2b9dced51
MD5 SHA1 SHA512

Submit Download

memory/3412-0-0x0000000000650000-0x0000000000675000-memory.dmp

Download

memory/3412-18-0x0000000000650000-0x0000000000675000-memory.dmp

Download

memory/3836-15-0x0000000000DA0000-0x0000000000DC5000-memory.dmp

Download

memory/3836-21-0x0000000000DA0000-0x0000000000DC5000-memory.dmp

Download

memory/3836-23-0x0000000000DA0000-0x0000000000DC5000-memory.dmp

Download

memory/3836-30-0x0000000000DA0000-0x0000000000DC5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads