urelas | 8c0379616e8763625067bd301f69d42121f14b49b6103d5f6b994a8c12bd90e7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe
Size 109KB
Sample240831-pb7dqssejk
SHA256 aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72
MD5 deff28358eac41c1f219bebcc29d366e
SHA1 4d6e467367b23200d94646abcac6007a591dbff9
SHA512 7b82181d2161c139bf55b27f81bfae231dda61ee4b424cd1dcd88189ed20998222c2871f3ce2036c0e1f964a51645aa0b36eac2178bd4bc8feabb204d6bccd7f
SSDEEP 1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI9g:4tCc+/h0fmSid81L64TGVI9g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe

Executes dropped EXE 1 IoCs

pid	Process
4752	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4752	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	87
PID 4852 wrote to memory of 4752	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	87
PID 4852 wrote to memory of 4752	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	87
PID 4852 wrote to memory of 1612	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	88
PID 4852 wrote to memory of 1612	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	88
PID 4852 wrote to memory of 1612	4852	aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe	88

C:\Users\Admin\AppData\Local\Temp\aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe
"C:\Users\Admin\AppData\Local\Temp\aefb105ec1746be7b45d22b3fdd19d9d1f7924e3fec8c60565f0d7ae7a14fd72.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 109KB
SHA256 3a9b7e886a9f8515eb792977642ec5b6a21832e98408ccf3f187fe3af5032337
MD5 a61cb89fb12d7233d9546145e0cca668
SHA1 48aca9ddac622c494010bf308e3e47197725e59c
SHA512 6711a03975f3b06fe2ac4094837e6704daf2ef9940ee3242b62da704d8bcfb9279abbfda733c3cccad0b33f6bd8a98f6dc84f51224b628ecdbce067f201ea903
SSDEEP 1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI9S:4tCc+/h0fmSid81L64TGVI9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7
MD5 429d29b7501cff75ffd4e7af0b24db41
SHA1 53808fde744d4d65aa2f4c48e8644a65f81be038
SHA512 83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 8d61558617ff719f6b1cc97c570c7fa6915458e1786ff26d12e99a39f3221c8a
MD5 12bce91707cd9a20006a34d25958be76
SHA1 efe0a554dd6393072f2b7770304c1abc7bfa1aa6
SHA512 1d898b3bbddee77c3f21b3a1490af300aef5577228a327d5a885a691ed171ab1678f8368078366eaf8f7a0e0c196cd7cd882957db780f8bf841d9cbcc589fe79
MD5 SHA1 SHA512

Submit Download

memory/4752-12-0x00000000005D0000-0x00000000005F4000-memory.dmp

Download

memory/4752-17-0x00000000005D0000-0x00000000005F4000-memory.dmp

Download

memory/4752-18-0x00000000005D0000-0x00000000005F4000-memory.dmp

Download

memory/4852-0-0x00000000008A0000-0x00000000008C4000-memory.dmp

Download

memory/4852-14-0x00000000008A0000-0x00000000008C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads