urelas | 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d

General

Target

3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
Size

61KB
MD5

1991fa7f68eb51bda59c016cc5736385
SHA1

857090a6439901aeca151e45507eace8d00589b0
SHA256

3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d
SHA512

3d73f857024b2fb20e338c4fae0d0db4c7562e3a7a8bb36db066ccf85fb14fb322996cc13d373926ae6de2215c8dad0bf7e95c91d34d96e674deaba7f239b239
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVz:Jo0cAthu6+FQ0JuPkz

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

4664 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4664	biudfw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe

description	pid	process	target process
PID 1028 wrote to memory of 4664	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	biudfw.exe
PID 1028 wrote to memory of 4664	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	biudfw.exe
PID 1028 wrote to memory of 4664	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	biudfw.exe
PID 1028 wrote to memory of 2348	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	cmd.exe
PID 1028 wrote to memory of 2348	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	cmd.exe
PID 1028 wrote to memory of 2348	1028	3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
"C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
61KB

MD5
bb4b322fee271a5a631167637e39aa3d

SHA1
b576d43438a586af45bda3fd1714244b0157e040

SHA256
abc847b9f97d6702fc3872445ed1ae61b51e48308104f7aff8e52c9d1e5e8416

SHA512
62778cc497600e8e8415cd3a66ec1122dd036fde603b19fefe0a4ee3d951a9cf3ee1b85b97e5ac7c3f3a41062d11ff5ef1c2d6856ef53dfd71403d6ff9d83c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
b2f167d976fbab4ebcad72be5625f596

SHA1
0a79af93d0857c93a01cfd402228775c49949abb

SHA256
a9465f51a25bf51cb3447e223c87bcc83f651554147eecc3f2436af2b2244c4c

SHA512
f62fa12998f5c82f99068b9d9e82977fa35a02ccdd4bfdc7c97015b2e5ccc63a3294f9eec1b8c7a74908d3451750d157c5a8c0631c0ffc5e0cccff358125dee6

Download Submit
memory/1028-0-0x0000000000290000-0x00000000002B5000-memory.dmp

Filesize
148KB

Download
memory/1028-17-0x0000000000290000-0x00000000002B5000-memory.dmp

Filesize
148KB

Download
memory/4664-14-0x0000000000010000-0x0000000000035000-memory.dmp

Filesize
148KB

Download
memory/4664-20-0x0000000000010000-0x0000000000035000-memory.dmp

Filesize
148KB

Download
memory/4664-22-0x0000000000010000-0x0000000000035000-memory.dmp

Filesize
148KB

Download
memory/4664-28-0x0000000000010000-0x0000000000035000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads