urelas | ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
Size 64KB
Sample241012-rfqynayepk
SHA256 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2
MD5 5b3681183fcac84310c399ddf00064f0
SHA1 f4e9b64b88aece299daff568a1c00d8d4404d7af
SHA512 160cfb001d94e566005487236d8455d5a2b5f48e892e97dc8cc8c44f6a009ed7d0739c9d68f5dd3bb3e72ee28ea74bb62d1e200ed9e158a744f1ced82f1feda6
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/o:6bQRSHpAvzyf7MzeTYo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe

Executes dropped EXE 1 IoCs

pid	Process
2868	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2868	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	86
PID 4624 wrote to memory of 2868	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	86
PID 4624 wrote to memory of 2868	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	86
PID 4624 wrote to memory of 788	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	87
PID 4624 wrote to memory of 788	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	87
PID 4624 wrote to memory of 788	4624	ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe	87

C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
"C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 64KB
SHA256 0056215373ba8f7413f065cb7c9158dbe08e5bd5c6b4e8c8e763fcd3fff2c4cb
MD5 ba3d1928e8e5ce6b32367aa65fa19036
SHA1 0563de0c7c546cf5384f802cde98c42fde12d521
SHA512 e4b52506d6212805be8af805927d98020b77216e6f87c813e6266e23777f2b8c542ba216f328a624b21fc9cbcf690e7614f8b6fe3e6de20fa91a0f8eb3a7fed6
SSDEEP 1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/c:6bQRSHpAvzyf7MzeTYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
MD5 efd90b3ac908d5482af367de3a82184a
SHA1 de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA512 6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 340B
SHA256 32c8eaa5d1514a1b8920543cbb2e86686812ef8d678ab6a092686398679beb01
MD5 52de364334f68538894034967dfa7b25
SHA1 d394b860ff927b3ea1504d8bbf73aaa61a450895
SHA512 45aeecea873ce57713bc49e65fb398f90a725ad1210e9b31feee0debe6a9df31c9c7345f1f5546b56cfa52c6ed1de0542ebf405aa0352ebed302bbc3b1407de5
MD5 SHA1 SHA512

Submit Download

memory/2868-13-0x0000000000610000-0x0000000000635000-memory.dmp

Download

memory/2868-21-0x0000000000610000-0x0000000000635000-memory.dmp

Download

memory/2868-23-0x0000000000610000-0x0000000000635000-memory.dmp

Download

memory/2868-30-0x0000000000610000-0x0000000000635000-memory.dmp

Download

memory/4624-0-0x0000000000FC0000-0x0000000000FE5000-memory.dmp

Download

memory/4624-18-0x0000000000FC0000-0x0000000000FE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads