urelas | e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bf

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe
Size

65KB
MD5

bdfc6bfdef7c5435f691359d7eaa0860
SHA1

1a8dc8142fc1b2b7cba8a9502dc1203b2d9b20da
SHA256

e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bf
SHA512

c515bd3a6e375a47f5a23a6d8dd6ccf378420a06797692c7a8eb54f8350c2ebc93ff069afee7b9c59fe67fdcbd13bbdf46d0131472125c09974cf4f30e803a8d
SSDEEP

1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTmUD07yg:6bQRSHpAvzyf7MzeThD07yg

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe

Executes dropped EXE 1 IoCs

pid	Process
4428	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4428	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	90
PID 4120 wrote to memory of 4428	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	90
PID 4120 wrote to memory of 4428	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	90
PID 4120 wrote to memory of 4300	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	91
PID 4120 wrote to memory of 4300	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	91
PID 4120 wrote to memory of 4300	4120	e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe	91

C:\Users\Admin\AppData\Local\Temp\e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe
"C:\Users\Admin\AppData\Local\Temp\e40ac6982d1a3acb94f7bcf8fd221465cd799bb3ced7944d328fdf30778b23bfN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
65KB

MD5
dce0315ec0aab187c84c3ed2e03e0f31

SHA1
f5075161b6c5b4728ed0e70756f842b7b09a37e6

SHA256
beafedd944b20318aeb3bad24faf9435bdc391e5d86bdc7f08694d7b040c65b8

SHA512
0c5503112ed210c62c99c3d18f487a56ad3e10c8e1a3d0108f111489e752ab648a804fe2f0fb2b9175ae6db21947b0ef6c118aab336a3b5c8b0be107a4541f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
efd90b3ac908d5482af367de3a82184a

SHA1
de9f01d2ed0247b7b347e55c5a09721a60147fb9

SHA256
44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d

SHA512
6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
c5452b4943438b046909c026ce157fdb

SHA1
892528941dcf9b6fb2a8c93d40c05761f45c2f70

SHA256
2a454d7ebcf2e230b42deaa5f3dcd16204335ec17501083afc0d52c965f3a6b2

SHA512
4cab16950dcf5fa90e29c2cc5e201588bffe011816d7dfd930b507eaae86230b0b6a685ab91feda911ff4c8964aa3453011237fe74432fce5dbb4c955f6c3b25

Download Submit
memory/4120-0-0x0000000000F10000-0x0000000000F35000-memory.dmp

Filesize
148KB

Download
memory/4120-18-0x0000000000F10000-0x0000000000F35000-memory.dmp

Filesize
148KB

Download
memory/4428-12-0x0000000000E60000-0x0000000000E85000-memory.dmp

Filesize
148KB

Download
memory/4428-21-0x0000000000E60000-0x0000000000E85000-memory.dmp

Filesize
148KB

Download
memory/4428-23-0x0000000000E60000-0x0000000000E85000-memory.dmp

Filesize
148KB

Download
memory/4428-30-0x0000000000E60000-0x0000000000E85000-memory.dmp

Filesize
148KB

Download