urelas | 82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aa

General

Target

82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe
Size

272KB
MD5

ac8bf2e5d6913198ca725bcadd2850b0
SHA1

85e654d8996ff42801f7236d9a9491cc511898ba
SHA256

82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aa
SHA512

2b2874be2bc2250d7978a583e458066d78aff12d1162ecad998852a8f3c4352e0406f3fac730e275a141c7593dbac802ec6e271e6e7b6fc6ddb37f6d34513e7a
SSDEEP

3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jj0e:pOzRWu27dlOd5W0r

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2252	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid	Process
2508	biudfw.exe

Loads dropped DLL 1 IoCs

Processes:

82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe

pid	Process
2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exebiudfw.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe

description	pid	Process	procid_target
PID 2520 wrote to memory of 2508	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	30
PID 2520 wrote to memory of 2508	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	30
PID 2520 wrote to memory of 2508	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	30
PID 2520 wrote to memory of 2508	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	30
PID 2520 wrote to memory of 2252	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	31
PID 2520 wrote to memory of 2252	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	31
PID 2520 wrote to memory of 2252	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	31
PID 2520 wrote to memory of 2252	2520	82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe	31

C:\Users\Admin\AppData\Local\Temp\82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe
"C:\Users\Admin\AppData\Local\Temp\82ec056d7dd56179f06d3681c2b342a385d860b1885a1800f71e11be6d8653aaN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
ac5e84ed8031d66a9fcd5e472ba8091b

SHA1
06303add604104d6abbb69458f89773c066b470c

SHA256
3a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5

SHA512
7bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
9411a7e5b4e13d2663f59583cdf06c3a

SHA1
6e556e2b41d17e1ceab0d7d5189c5d5b5223e365

SHA256
c918d267437f73d3dba5d374e39a0c944d6bb7a8de7788578252bf75367506c1

SHA512
43616f452682ee7148fef9ace69ca2d71d2236d5697ef83c1cd19c413295383740bc2104d5037f7dab0f83d403a4869ea878f03da875ef24ed6994fa5f222590

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
272KB

MD5
968bce6ea6159b9f708c13905e31c7f4

SHA1
701b11f54c350c155dcafb47e99f7d9d6f67b372

SHA256
53980b244273927503de511a5b0af3155daf0ce5ddb6bf99492f739c35c18b92

SHA512
e5f565748a3484f8a1fa3095b1e5e1f01c3255e0f3f5f7cff3b1bafff57bf148dec8f954e4896722b88c4863a1c38959fe0b44c3265d835cb68c196531fd50d4

Download Submit
memory/2508-17-0x0000000000890000-0x00000000008D6000-memory.dmp

Filesize
280KB

Download
memory/2508-21-0x0000000000890000-0x00000000008D6000-memory.dmp

Filesize
280KB

Download
memory/2508-22-0x0000000000890000-0x00000000008D6000-memory.dmp

Filesize
280KB

Download
memory/2520-0-0x0000000000B10000-0x0000000000B56000-memory.dmp

Filesize
280KB

Download
memory/2520-10-0x0000000002BA0000-0x0000000002BE6000-memory.dmp

Filesize
280KB

Download
memory/2520-18-0x0000000000B10000-0x0000000000B56000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads