urelas | a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadf

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe
Size

60KB
MD5

3a9d1312d8b678aab7ca27dbbb851620
SHA1

d2df98549bcf20190b4a06da0c4f5c629a1c1f20
SHA256

a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadf
SHA512

f0d3e1a58993e99359ec6f69a4734ea25977401cad7456d1b4c658188508269fe6b5c86974a0131fd77c35d9d24053a0b749dabc6982fc7ad9cf4d5ca81bc3e0
SSDEEP

768:jb4zb59Yix/RoyH+5flZirYqc97vFvrpaZG3DHvTdA9GgnOuS5Z3WXcKIZx5uYjm:jbQx5oPsr2vFxDPhAvzgdWLIZ7vGH

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe

Executes dropped EXE 1 IoCs

pid	Process
4420	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4420	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	90
PID 1660 wrote to memory of 4420	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	90
PID 1660 wrote to memory of 4420	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	90
PID 1660 wrote to memory of 2188	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	91
PID 1660 wrote to memory of 2188	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	91
PID 1660 wrote to memory of 2188	1660	a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe	91

C:\Users\Admin\AppData\Local\Temp\a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe
"C:\Users\Admin\AppData\Local\Temp\a3f416e56091e44f9ae67b9fe9e906bf814c4a7b08bc2d2393df77ab89eafadfN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
5a9b4891caa88be67e55d0499b59f66b

SHA1
ae2aed2bfd4e441f015698eb87e33b40e8540ea5

SHA256
69dabc0eb8f68f64257ec81485a1075a27f61775d22474fa35e848a92fbc2508

SHA512
8d211169b4d72e7e019060d253719f93291fee7cd35a31f87e4cd474892b740a1dc071116fe1be85db0a32489e29bc0cbff6c066029792a5fbf7db9a499c2d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f02bf69ff6351970bce3b50742a769ed

SHA1
577db2279b6489628583d770f441f3316ff2a560

SHA256
df6e69fc42308fb3e8b6ec778c1ba6afa4ec11d0414c86299df8b573a51f13c0

SHA512
42a7fc0af80713ece991b51ce908444414162de5cb704d1e538794db7fca217fe3d9bfde19d7661f62ccd1d8ec3de362675094f364daf48624ace9e9e2239979

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
b420cec1ed0b18c1673e3cb4c8091003

SHA1
480e7286c62aa641e6f3baccea849c7c3bccf385

SHA256
ff9240b084d79e1e870bd222475e8a9da2b254a7bc5cf88eb34caa895de7f34b

SHA512
e5901ff6897cba61142b62ed58adb1df1bba8b8ba05b546372180493eae23b4f95ecfe291a5c156610bcda3682444cbef511d55dc9bd1885ada35c5f83ec208f

Download Submit
memory/1660-0-0x00000000009C0000-0x00000000009E5000-memory.dmp

Filesize
148KB

Download
memory/1660-15-0x00000000009C0000-0x00000000009E5000-memory.dmp

Filesize
148KB

Download
memory/4420-10-0x0000000000F80000-0x0000000000FA5000-memory.dmp

Filesize
148KB

Download
memory/4420-18-0x0000000000F80000-0x0000000000FA5000-memory.dmp

Filesize
148KB

Download
memory/4420-20-0x0000000000F80000-0x0000000000FA5000-memory.dmp

Filesize
148KB

Download
memory/4420-26-0x0000000000F80000-0x0000000000FA5000-memory.dmp

Filesize
148KB

Download