urelas | b082a2e7b25020c3775dd62d3990ec5b0d633e66d6e9d6a7131c93d2fa1248c2

Analysis

max time kernel
132s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe
Size 139KB
Sample240831-drmtgssfme
SHA256 8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39
MD5 7a5874812f14d24f281db552be3c44dd
SHA1 73a84ac62f85a8e32a561d855a151cde8ed75041
SHA512 72a11177679671b3bc8beb341644a66d4b45ebbdc77965f749bf6ceda8ad396fa9015dcedccfe4f19d9e7e687d3d96e1c067357cfff82cbd8270281e5004f6a0
SSDEEP 1536:sJoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd0sWz64TNdFOG:DtCc+/h0fmSid01z64TNdFd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe

Executes dropped EXE 1 IoCs

pid	Process
1572	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1572	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	90
PID 3572 wrote to memory of 1572	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	90
PID 3572 wrote to memory of 1572	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	90
PID 3572 wrote to memory of 1612	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	91
PID 3572 wrote to memory of 1612	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	91
PID 3572 wrote to memory of 1612	3572	8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe	91

C:\Users\Admin\AppData\Local\Temp\8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe
"C:\Users\Admin\AppData\Local\Temp\8f192e2834b5e1f9ad9602dd8b59e11c0f15cc6fe5696933e029f9f638ab0a39.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 139KB
SHA256 2a298d137b14238de89a9d55c65ea6391ad5622a3beefcf4885dfa830e9b378b
MD5 8eebfad834763bddd3c662214818b50e
SHA1 5a50052cda1a62d12dcc4e04c12671972c78a657
SHA512 2c8dcd9e43d2436178a80ec3c1e519a470122e7dff8b53296af85e6d4227af7a6e9aaa9777e10413e89ba5846d693abe3d23e3b2e799a4787a21c4b56463a20a
SSDEEP 1536:sJoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd0sWz64TNdFOJ:DtCc+/h0fmSid01z64TNdFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1cd0e40fbd293b64f598336c2718168ba1a6bb78500d6dec5b75692254e8eb47
MD5 e67f2f1e106875a43125b0e1212ab553
SHA1 e58d195aa84263e0b267116e482c96b18ebb0216
SHA512 d21f6881c2e785a0edd7c1cbd42d740592bfa29b36215215be4689ccb3d97c06c9099c95b87bbba9d298e732e6c75942ad663bb82061ccfc06f6d9ada91640ae
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 475082c320b833954a100fc911d05a96a03d9d2b53f43b58c33fa3d3d89c0ce7
MD5 4cdd21c0ae4d7115e22a7707906c81b6
SHA1 e55d8509f8d35b13bdaba86b6a8ea5d077a72220
SHA512 00beb55250435b2f0d5ee039a57faf8c2fea349e28dcbe24c9297c60dec13b48d2450f6309b8a1db2bad848dbcfc59e6978cd03ddbde845249fd7ec2169b77ce
MD5 SHA1 SHA512

Submit Download

memory/1572-12-0x0000000000990000-0x00000000009B8000-memory.dmp

Download

memory/1572-20-0x0000000000990000-0x00000000009B8000-memory.dmp

Download

memory/1572-21-0x0000000000990000-0x00000000009B8000-memory.dmp

Download

memory/3572-0-0x0000000000010000-0x0000000000038000-memory.dmp

Download

memory/3572-17-0x0000000000010000-0x0000000000038000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads