urelas | d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe
Size 58KB
Sample240920-cqewtavaml
SHA256 d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712
MD5 a31fac052cee28e0644e868a14f9c130
SHA1 ae119e712ac851bbe8b1abe6e96892feb5e5aec6
SHA512 0afb2369eaa7dc87db33c24e3ac7dddfce641fa7c621a72f0176a56967ae78d10e2e2af5ec9a4ce124a4a19c070ae79326af524d4e4f6fb25686793c8ea8f4eb
SSDEEP 1536:6W82C0Db1edMckBI1kmJAhTPY6pnouy82n:6n25DbaMySmJAhbvout2n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe

Executes dropped EXE 1 IoCs

pid	Process
1856	biudfw.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3160-0-0x00000000004D0000-0x00000000004FC000-memory.dmp	upx
behavioral2/files/0x000700000002344e-6.dat	upx
behavioral2/memory/1856-10-0x00000000004E0000-0x000000000050C000-memory.dmp	upx
behavioral2/memory/3160-15-0x00000000004D0000-0x00000000004FC000-memory.dmp	upx
behavioral2/memory/1856-18-0x00000000004E0000-0x000000000050C000-memory.dmp	upx
behavioral2/memory/1856-20-0x00000000004E0000-0x000000000050C000-memory.dmp	upx
behavioral2/memory/1856-27-0x00000000004E0000-0x000000000050C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 1856	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	82
PID 3160 wrote to memory of 1856	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	82
PID 3160 wrote to memory of 1856	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	82
PID 3160 wrote to memory of 940	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	83
PID 3160 wrote to memory of 940	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	83
PID 3160 wrote to memory of 940	3160	d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe	83

C:\Users\Admin\AppData\Local\Temp\d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe
"C:\Users\Admin\AppData\Local\Temp\d4cd5ec548e75ba64cca6243f7611e22ada01c95bc01a4e2ca379f3da5da3712N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 58KB
SHA256 7f4c263b037200c73eb0bb6a8563743beeb80b8358f6b60de05c25b6ef8d347f
MD5 53fc1ba01c74c4d45e60eac74f576156
SHA1 7382666d843d941dd7f48d9b917175073aa487a1
SHA512 39cf1e542c3c17ecd17c2cd465cd74e887b854f1fbd4ce95630fdac6d45af00a271392529d4f8a7fc79cf1aca3bc5d9dc648cdaae8e7ac9128d5605d78370f48
SSDEEP 1536:6W82C0Db1edMckBI1kmJAhTPY6pnouy82O:6n25DbaMySmJAhbvout2O
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46
MD5 b4a86880004da8726288d7ec954885a8
SHA1 1bab1cfbdc2c540246210bc7852f8fe7e8357b31
SHA512 22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 340B
SHA256 9c1f056c6e9274791351b559587be2a6d4877db0067658926194f45021c49161
MD5 ddc6b2a5011b64d62c358564703fee25
SHA1 789edf1f6c4682eb9c9289b93edfdc1c319dc449
SHA512 e4de95f67452598065b574dd4b16fe68203e92e22be931e8791b44ca4e30a06a0ebd5d2a2d552ad45338dabf78b76b4c14644f6e28bd91da7527eec5636d79e4
MD5 SHA1 SHA512

Submit Download

memory/1856-10-0x00000000004E0000-0x000000000050C000-memory.dmp

Download

memory/1856-18-0x00000000004E0000-0x000000000050C000-memory.dmp

Download

memory/1856-20-0x00000000004E0000-0x000000000050C000-memory.dmp

Download

memory/1856-27-0x00000000004E0000-0x000000000050C000-memory.dmp

Download

memory/3160-0-0x00000000004D0000-0x00000000004FC000-memory.dmp

Download

memory/3160-15-0x00000000004D0000-0x00000000004FC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads