urelas | 606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572d

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe
Size

57KB
MD5

3e729ff667755e3013c0208b90f8d470
SHA1

3103c927ff71b3f97d07c97b63fcd48a3a973dbb
SHA256

606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572d
SHA512

de83a9554730f3f523bec965a0c680102fd3e22cf61e439f94a2ef710f7a08ea748c10befed9f89a175cfc22ff49c2e4599628c9626c076a03fb63b4e533afa2
SSDEEP

1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8y:MOemdTd1o74qlmbbJ+x+IkA

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe

Executes dropped EXE 1 IoCs

pid	Process
4448	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4448	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	87
PID 4108 wrote to memory of 4448	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	87
PID 4108 wrote to memory of 4448	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	87
PID 4108 wrote to memory of 2780	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	88
PID 4108 wrote to memory of 2780	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	88
PID 4108 wrote to memory of 2780	4108	606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe	88

C:\Users\Admin\AppData\Local\Temp\606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe
"C:\Users\Admin\AppData\Local\Temp\606c454ee732e2e5cfee7786df5787f77ef0dce745205de62f760ef62847572dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
57KB

MD5
9bc95aadcacb2c25bb37034f99b215c1

SHA1
f667ff9f4f7882f00e11d01b0744eb10c96c326e

SHA256
f3c44f11db517f33add80ffa33f271615d438ca7f70bccd2c7e49d03ba8025b1

SHA512
23a51d503aaa6ad3d67a35c011206458f760f17c5e37a418783d79ead324a0b83d2d9c31fb1ad4f9ca02e03e22341aa9230ea40a795792e551bb6943c97c8c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7cdc8777d33db85bc19aefb64879a7f7

SHA1
f2d494d4dfe93a05eb58513935196e8578648adf

SHA256
9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336

SHA512
34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
8063f776b54592f243b5f4aad2c84ec7

SHA1
42232a4f4a3be66de201753833712625f691112f

SHA256
e6ef4e0dd1bc3d1b49ad49dac1d1a4593c890a8c903439f05f2028457a2666aa

SHA512
140ae7df0b49ca62bff264115a8784c8dfcde8a923bd58116b90e5d4724792f096b6b2cd7e75e3576ca9b8908e7a55a6afd8f22c75261d1ac6baa3968a60a5bd

Download Submit
memory/4108-0-0x0000000000ED0000-0x0000000000EF6000-memory.dmp

Filesize
152KB

Download
memory/4108-15-0x0000000000ED0000-0x0000000000EF6000-memory.dmp

Filesize
152KB

Download
memory/4448-10-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/4448-18-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/4448-20-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download
memory/4448-27-0x00000000000D0000-0x00000000000F6000-memory.dmp

Filesize
152KB

Download