urelas | e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe
Size 64KB
Sample241008-ejrm5sxgpk
SHA256 e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45
MD5 7c2f3ce1d5812e836119dd63371c72f5
SHA1 3a52b35bf870351d97efb73be3fd74a9389cbbc1
SHA512 728403cc9613eb1ad9341a4b327c849730dbfe43b41f7107e3a7ef1cba7a2534656fa23311a244a367ca0e662418a9e2315fe6a59f2953e49b879952fa31b824
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/l:6bQRSHpAvzyf7MzeTYl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe

Executes dropped EXE 1 IoCs

pid	Process
3068	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3068	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	86
PID 4028 wrote to memory of 3068	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	86
PID 4028 wrote to memory of 3068	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	86
PID 4028 wrote to memory of 4204	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	87
PID 4028 wrote to memory of 4204	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	87
PID 4028 wrote to memory of 4204	4028	e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe	87

C:\Users\Admin\AppData\Local\Temp\e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe
"C:\Users\Admin\AppData\Local\Temp\e5eefe1651e793cd90eeb1b249b0468bac77692c91d3a2278a8384ede32b4d45.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 64KB
SHA256 cace96c1e4c87ecf7738f98962a8eb42bc79ebf5d57936173f92a7212c4781a1
MD5 e4e8c2e126d6b7b7cca339e070424fec
SHA1 deec76f8142a6ca4fd097cb817185b052dc15bbf
SHA512 57a3332cdd294a5849262b83feebe8f6826376d7e24e2392699fbbab67d64c86ae3adca5874ec06cf072ba54969a94e406931e23c28ebfeb0bca8155f0c3e1b1
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/w:6bQRSHpAvzyf7MzeTYw
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
MD5 efd90b3ac908d5482af367de3a82184a
SHA1 de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA512 6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 96026e9d1443dfa05f196d715ce5c201dc845fbe761e13d94e9c8c501faa7d09
MD5 392b9598244584ca33cdb0d6dedd4741
SHA1 8c3d39e3c90e5c8e906fe1817d4c427096fb9df3
SHA512 f6ee9f839f42c153effb116b5b9f9c598b70b5c4360ea5bb374456b37f6eb8041e96313fb8bd42cae3114e956c295d350ac5cfc0f802e5ec029639c05bb6fc5a
MD5 SHA1 SHA512

Submit Download

memory/3068-13-0x0000000000440000-0x0000000000465000-memory.dmp

Download

memory/3068-20-0x0000000000440000-0x0000000000465000-memory.dmp

Download

memory/3068-22-0x0000000000440000-0x0000000000465000-memory.dmp

Download

memory/3068-28-0x0000000000440000-0x0000000000465000-memory.dmp

Download

memory/4028-0-0x0000000000110000-0x0000000000135000-memory.dmp

Download

memory/4028-17-0x0000000000110000-0x0000000000135000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads