urelas | a1dce75258030f583e59442ead10a1aa7517e677c937d8d19f2a38b17e5b194f

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
Size 59KB
Sample240902-dkhaeszdrp
SHA256 9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0
MD5 02449ec9c41d7c3f882d1fc16cba1c2c
SHA1 1487781103918ed72db84c9aba0aad0f810eeb3c
SHA512 62e2b895463aea667bb54824d62c77ab29d96b41e80f6314d9510bcad970c335df5ceca0214af4a895f09d37b4c47a8a4db510c7e1257791c9d362c1c3692398
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPW:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe

Executes dropped EXE 1 IoCs

pid	Process
716	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 716	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 4128 wrote to memory of 716	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 4128 wrote to memory of 716	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 4128 wrote to memory of 5068	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88
PID 4128 wrote to memory of 5068	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88
PID 4128 wrote to memory of 5068	4128	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88

C:\Users\Admin\AppData\Local\Temp\9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
"C:\Users\Admin\AppData\Local\Temp\9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 59KB
SHA256 16c65f1ffbf6672d2d43b5f890e1d24257d533a0507b115bd9fc702239d6cb4b
MD5 fc2c9634385786a4f64b051ffe575055
SHA1 5f5b2a68c71ca8b09b1ecc941f6241c4997beaf6
SHA512 ab9b5aab4c05496dde396787f1c20d8a3cffa2a526e714dd43b50511a84b87987a56b4100d3367cd57bdfd4c1765b174e48c6b5a67267f46891d8f8c01e27bbc
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPk:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdr
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 81f0ff76f6e2d0e81c72367da68579ff3c19c7e93bd2110b5ce9ed2c60f0221b
MD5 bb9e7756f70bb7d4e303c65867604a90
SHA1 5d41fabdf21c61c588674e4de6096e5211f1c608
SHA512 65135b26410318b79432f3f4e638cb5098c14a44e5158627ca9b6efc466124e10f229562e498db1782caf9be0e77c70ff41b1444f82359945c114a33d4861344
MD5 SHA1 SHA512

Submit Download

memory/716-10-0x0000000000250000-0x0000000000285000-memory.dmp

Download

memory/716-18-0x0000000000250000-0x0000000000285000-memory.dmp

Download

memory/716-20-0x0000000000250000-0x0000000000285000-memory.dmp

Download

memory/716-26-0x0000000000250000-0x0000000000285000-memory.dmp

Download

memory/4128-0-0x0000000000210000-0x0000000000245000-memory.dmp

Download

memory/4128-15-0x0000000000210000-0x0000000000245000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads