urelas | 42cc5f742e9778fe76ac83ee925051bcb779e3e3c730c64168068e5336f83af9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe
Size 109KB
Sample240901-16282stgna
SHA256 10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f
MD5 df207e2d6fa8c83656632f0652b1ac3e
SHA1 e1660726ff8505f7d00f113a860970712e7c9198
SHA512 fdd75ec2780ced447cde12df18028bf6f15ddc667a11536435c9577501164f4b4ffd07ffcc726fc93bb0ca1d0a6175d13443e2c22ebf7e595780169e3e9ae59a
SSDEEP 1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI93e:4tCc+/h0fmSid81L64TGVI93e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe

Executes dropped EXE 1 IoCs

pid	Process
3836	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3836	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	89
PID 1708 wrote to memory of 3836	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	89
PID 1708 wrote to memory of 3836	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	89
PID 1708 wrote to memory of 4832	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	90
PID 1708 wrote to memory of 4832	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	90
PID 1708 wrote to memory of 4832	1708	10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe	90

C:\Users\Admin\AppData\Local\Temp\10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe
"C:\Users\Admin\AppData\Local\Temp\10b5ff9b81639324658dde456ad3ae8b495472b09e3a249a09caa2432152618f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 109KB
SHA256 764289a76ce0a59b8e417e5f05944ec12bc419e43be902d22f386c68383dc83f
MD5 a4e1a386f6fee4b63adde770ba859fa9
SHA1 a741f0c624b0e518d4ca1a29ab94dfa514e485c4
SHA512 95b3cbd4a9cce0dc55816b5383d3b3d12bf268561d1d2e5a74ad699bc77639bd715873a4cc5b640d41fcae9c96571474ad2e9803402ebefaf7a0885e0607a357
SSDEEP 1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI934:4tCc+/h0fmSid81L64TGVI934
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7
MD5 429d29b7501cff75ffd4e7af0b24db41
SHA1 53808fde744d4d65aa2f4c48e8644a65f81be038
SHA512 83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 3024d2e3fb61e0aedbaad989d59795aa59659ab8db1769f637dbfe4348d0547b
MD5 9c4ea68924dff0a69e6368d077001541
SHA1 0e1b02bbbc2106592a823747f2007134a45a9b5b
SHA512 d762da7b8935b8d1c94f197b0c56a92a1a7f97f2d325bb1c663d6eeff1ad3a288c047013565ce7b41d4b2da4eb3e37def46219fe19a4475b383002ac2a5a4457
MD5 SHA1 SHA512

Submit Download

memory/1708-0-0x0000000000050000-0x0000000000074000-memory.dmp

Download

memory/1708-14-0x0000000000050000-0x0000000000074000-memory.dmp

Download

memory/3836-9-0x0000000000CB0000-0x0000000000CD4000-memory.dmp

Download

memory/3836-17-0x0000000000CB0000-0x0000000000CD4000-memory.dmp

Download

memory/3836-18-0x0000000000CB0000-0x0000000000CD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads