urelas | a1dce75258030f583e59442ead10a1aa7517e677c937d8d19f2a38b17e5b194f

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
Size 59KB
Sample240902-g5g2yaverf
SHA256 9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0
MD5 02449ec9c41d7c3f882d1fc16cba1c2c
SHA1 1487781103918ed72db84c9aba0aad0f810eeb3c
SHA512 62e2b895463aea667bb54824d62c77ab29d96b41e80f6314d9510bcad970c335df5ceca0214af4a895f09d37b4c47a8a4db510c7e1257791c9d362c1c3692398
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPW:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe

Executes dropped EXE 1 IoCs

pid	Process
1364	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1364	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 2072 wrote to memory of 1364	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 2072 wrote to memory of 1364	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	87
PID 2072 wrote to memory of 2176	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88
PID 2072 wrote to memory of 2176	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88
PID 2072 wrote to memory of 2176	2072	9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe	88

C:\Users\Admin\AppData\Local\Temp\9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe
"C:\Users\Admin\AppData\Local\Temp\9b92147969e402052a6e43060a1fa7357ae419b75a6031c57b8487050eae58f0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 59KB
SHA256 1a3f9ea97a6589e4e82fadb468a3efda40a88705cda0e0a88717c3829356bf25
MD5 dacbcdc29b52cac596bf83ff7c6e23fc
SHA1 255dcec67e9c95cd22f57c93220091b6ec0630ad
SHA512 dc695d75082fec4c8b987d45d03b704c08329be01f92626195a669fc4af8b2c57eacdebeea00e2e29feb1ddd6cc00b2724c84cc3534e273683cda16ba591ec9a
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP6:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 81f0ff76f6e2d0e81c72367da68579ff3c19c7e93bd2110b5ce9ed2c60f0221b
MD5 bb9e7756f70bb7d4e303c65867604a90
SHA1 5d41fabdf21c61c588674e4de6096e5211f1c608
SHA512 65135b26410318b79432f3f4e638cb5098c14a44e5158627ca9b6efc466124e10f229562e498db1782caf9be0e77c70ff41b1444f82359945c114a33d4861344
MD5 SHA1 SHA512

Submit Download

memory/1364-10-0x0000000000DB0000-0x0000000000DE5000-memory.dmp

Download

memory/1364-18-0x0000000000DB0000-0x0000000000DE5000-memory.dmp

Download

memory/1364-20-0x0000000000DB0000-0x0000000000DE5000-memory.dmp

Download

memory/1364-27-0x0000000000DB0000-0x0000000000DE5000-memory.dmp

Download

memory/2072-0-0x0000000000930000-0x0000000000965000-memory.dmp

Download

memory/2072-15-0x0000000000930000-0x0000000000965000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads