urelas | 275a3a4b18fe9ba0e47f6b909d516b44ab8e010b2f6c2d99c3e678d8972cf0a0

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe
Size 60KB
Sample240831-banncawdnc
SHA256 38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c
MD5 52a3adee99cf65f1a8b8b2f7b821ad6a
SHA1 34e5a9f95709d72c17618cf16a6090c550fde587
SHA512 8a66941b2bdd27de63ab7cd560126c3851d87ccd591d2825c339cd4ea36dc0c1df0be3ee993d33410f64d16b05a8ed44fa729ee422cff7b80d6ee7f278cb9203
SSDEEP 1536:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdau4:K0GAqjuVZ6rNOau4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe

Executes dropped EXE 1 IoCs

pid	Process
1596	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1596	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	90
PID 1840 wrote to memory of 1596	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	90
PID 1840 wrote to memory of 1596	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	90
PID 1840 wrote to memory of 3472	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	91
PID 1840 wrote to memory of 3472	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	91
PID 1840 wrote to memory of 3472	1840	38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe	91

C:\Users\Admin\AppData\Local\Temp\38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe
"C:\Users\Admin\AppData\Local\Temp\38d2d3e670a3199c2105ac4b1b4efa3006c07dc1ebaea32ae3759f1eabfda66c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 60KB
SHA256 d9c8fc71f7897548619f8e85dd244fc00b52166ae541af51bd3f9a4cdf8d0a64
MD5 ed1a4f6143336c571a4697170aaddd0c
SHA1 c24c9a17af43ddf92cc3042002fd3927de987ff9
SHA512 555eff0e75de4c6019f06ac0ac80419812c6e70e0473a2c329a9d14e32174f072f98d7be7533477c7da44e990e8481efe5a9a8f5b27738bdb6934e30c0364ffc
SSDEEP 1536:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdauk:K0GAqjuVZ6rNOauk
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 fafef991e671989a53a17711c25a07355e2e24439b8710ea9a8c9a0af135ded1
MD5 eda2af00e87340b6c1bf7a7b28ec3376
SHA1 67e6afd6f91c321e03c1244e6a984a2252437d46
SHA512 79c683d03de6b9b723ace572a45373f5d148fb6dc7af94a25bd45b7ef85aeb0c34c3176953f1370eee2e3d0f09a9553b140cab1fbd4be847ef53c02ed4c915d7
MD5 SHA1 SHA512

Submit Download

memory/1596-10-0x0000000000BE0000-0x0000000000C15000-memory.dmp

Download

memory/1596-18-0x0000000000BE0000-0x0000000000C15000-memory.dmp

Download

memory/1596-20-0x0000000000BE0000-0x0000000000C15000-memory.dmp

Download

memory/1596-26-0x0000000000BE0000-0x0000000000C15000-memory.dmp

Download

memory/1840-0-0x0000000000CB0000-0x0000000000CE5000-memory.dmp

Download

memory/1840-15-0x0000000000CB0000-0x0000000000CE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads