urelas | e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfa

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe
Size

67KB
MD5

96b6d61a52490f9f803fb2f2fabddfd0
SHA1

72cf5e817bc5b582929fb70784ad7051d4d641b9
SHA256

e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfa
SHA512

54a52557d7dd1f631c30bb386ba102f2a0ed371eb61487b97e690f93c7449dad5f8a83f891933676d4cc2bc0f35690fb16740f474ef0a15ec3f53c92a1ff9c95
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCare/:yLAYUzmdD0sMQl7d7IuhCai/

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2844	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	88
PID 432 wrote to memory of 2844	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	88
PID 432 wrote to memory of 2844	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	88
PID 432 wrote to memory of 4552	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	89
PID 432 wrote to memory of 4552	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	89
PID 432 wrote to memory of 4552	432	e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe	89

C:\Users\Admin\AppData\Local\Temp\e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe
"C:\Users\Admin\AppData\Local\Temp\e8359c1b065cbad6c25945f39e031ba481d2727d2be43e04f76f52a26b043cfaN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
67KB

MD5
798acfbc2a2caf474e45ee0b30727190

SHA1
d6f625a200db6f28676a869efa3a1c79c03d669c

SHA256
fcc0f22b27dc97996a7317f0aeb36ebd43a350ffe68aa16df402838096c7f1b9

SHA512
50c161740174c2db3a813519e1d837dc427d76723ca97d9af1a1f72574411bd687b310c9b8ace39a737d9f292e62efe5aded8a2c307ddf84904f80ebe29ec7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
3b7876a402a802d973ad77b48e4d4127

SHA1
288b15fb6831001108b29f7f94c61cb091711f66

SHA256
9be9d2b5e3966ae15a88bac0ec0124b468b6a62bf2a942aac6b25b747f42480f

SHA512
f1b1e6caf25a0eb43ab74ccde3e12f191bb99e42138cc0fa919ab6565100fb50a8b0c78221a3a72a655ce257d5e23539e0f04a233c142f774dbf10e0e2c272a0

Download Submit
memory/432-0-0x0000000000DD0000-0x0000000000DF7000-memory.dmp

Filesize
156KB

Download
memory/432-18-0x0000000000DD0000-0x0000000000DF7000-memory.dmp

Filesize
156KB

Download
memory/2844-15-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download
memory/2844-21-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download
memory/2844-23-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download
memory/2844-29-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download