urelas | d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe
Size 56KB
Sample240910-c3snfavbjf
SHA256 d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028
MD5 52483d2646f1cba10c69a9d10ef71e9e
SHA1 21139c962538ffb12e652d7a70f531290bb496d6
SHA512 83c5b3f8ed924bc6f8affaea6b0fc155bbcbbc752a20e1cf3ac5d695eda395735cb7c1211a26b6fd41d687ae95c03b18880a1c903a140925bd161f0c3fd9e4dd
SSDEEP 1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1j:amZ+luXwy2f9LDhDj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe

Executes dropped EXE 1 IoCs

pid	Process
3160	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3160	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	89
PID 2676 wrote to memory of 3160	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	89
PID 2676 wrote to memory of 3160	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	89
PID 2676 wrote to memory of 3260	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	90
PID 2676 wrote to memory of 3260	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	90
PID 2676 wrote to memory of 3260	2676	d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe	90

C:\Users\Admin\AppData\Local\Temp\d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe
"C:\Users\Admin\AppData\Local\Temp\d38ed6063e6ec193f106074fefb6b4350aeeef97327f8136d913c549b813f028.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 56KB
SHA256 3ccb7faa34ba91c3172c4f17643de0ac4af295c5f723ed529251e43c829b622d
MD5 cd73361dea085c452554ebccb1777420
SHA1 4e28524b176e59cdc273b512190196735f065580
SHA512 40217c63cbfd958c0fa68683d6bc3eda5b90fbbc53d15df08430bc4924e7a41b11715f2720ced4554793077d3902d83c9a96c4adac79d90c0409dd2ee521257d
SSDEEP 1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1h:amZ+luXwy2f9LDhDh
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283
MD5 26625b4ca7658f7ba4dc7d982782323c
SHA1 574aa314998c39e683675ccf457b0305341a4aaf
SHA512 5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 c2c236e4822e174dff92710c003a12f0c0de07e812ce75fb4af3117451823bb8
MD5 b8032038e2e04656ce89fa5515829e03
SHA1 0d81f5836acd0b19ed0a4b06e4db1d9a53163075
SHA512 f31fc386716454caf4531a811485b2d0be1beee86012b314f1847feebda9151aadcca26aceb34484b5c98ca26dac62e3e072ea38b7cc7465d2df258fbdbc32e0
MD5 SHA1 SHA512

Submit Download

memory/2676-0-0x0000000000720000-0x0000000000752000-memory.dmp

Download

memory/2676-18-0x0000000000720000-0x0000000000752000-memory.dmp

Download

memory/3160-13-0x0000000000D70000-0x0000000000DA2000-memory.dmp

Download

memory/3160-21-0x0000000000D70000-0x0000000000DA2000-memory.dmp

Download

memory/3160-23-0x0000000000D70000-0x0000000000DA2000-memory.dmp

Download

memory/3160-30-0x0000000000D70000-0x0000000000DA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads