urelas | df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe
Size 60KB
Sample240908-dsk2aavbnf
SHA256 df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7
MD5 2cf0609b4e244a8381ffb30443153055
SHA1 4fe0886e40f4c3d2b9c0b7fc153d2de2939d4f06
SHA512 91b8fb5f4f1cf7d4cc099c2a07282e7b1d64cb00c7f113c343ff4e2f93f7df9d9c6032233a82f20db3002fd09b0f8ea6aedb5150f24ee98970f791b65d5fd716
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPO:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2264	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	89
PID 5012 wrote to memory of 2264	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	89
PID 5012 wrote to memory of 2264	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	89
PID 5012 wrote to memory of 3864	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	90
PID 5012 wrote to memory of 3864	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	90
PID 5012 wrote to memory of 3864	5012	df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe	90

C:\Users\Admin\AppData\Local\Temp\df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe
"C:\Users\Admin\AppData\Local\Temp\df9a05a2515732b15f07fed42c3ffe97c21428bf4ff59e5a96c98cd87041f4e7.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 60KB
SHA256 23211c94e4f9fb5757c1a600f55dd80eff0ab314cc607e10a31e5d61a82ade90
MD5 bda5cba6c19a441967a4032939109d05
SHA1 41fb6c995329c5eeb0c0b75f2cf72dda5f2aaf30
SHA512 0d1cd3c478b03a8d3f83f471d992e36af35887a50cb8fa946bba1afc6cd9c35ac44abe8bae2c159ca8acf5281653d7eaa3f65ca34ce1c02391d6ce48bda97604
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPg:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 05e49ee0c0113c60a96656d221e744c1a17696030f461f920e4a76d8f97e72df
MD5 ea33e9d539fc80bbd2f2874472e1d4fe
SHA1 1192f58b61fd9b0359e579c411532be11d2e3b56
SHA512 504e134c54fb2d1cc7b9d2072336d0e8beb0b527a351241c9cb33a23c4bf2a55430049838be8105a2aadb15cd9f4d8156a26b921638726e1f9f57932fbb3f033
MD5 SHA1 SHA512

Submit Download

memory/2264-10-0x00000000000D0000-0x0000000000105000-memory.dmp

Download

memory/2264-18-0x00000000000D0000-0x0000000000105000-memory.dmp

Download

memory/2264-20-0x00000000000D0000-0x0000000000105000-memory.dmp

Download

memory/2264-26-0x00000000000D0000-0x0000000000105000-memory.dmp

Download

memory/5012-0-0x0000000000BC0000-0x0000000000BF5000-memory.dmp

Download

memory/5012-15-0x0000000000BC0000-0x0000000000BF5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads