urelas | fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76f

Analysis

max time kernel
130s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe
Size

67KB
MD5

b04499472a96b12d4e66266c14d2d630
SHA1

3bca0d0b1f15584723f5dad28ee1dc521261bae2
SHA256

fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76f
SHA512

045fe7b2e30a8da0c1a60b8637381c0234ab5e507aac6ef8ef9cafe48e226b2712fafcb2788a9f9c92de77d1e7ffeece5161fc6674d215365c6fe611f0ddfb8c
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarQ:yLAYUzmdD0sMQl7d7IuhCaU

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe

Executes dropped EXE 1 IoCs

pid	Process
1436	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1436	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	89
PID 2124 wrote to memory of 1436	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	89
PID 2124 wrote to memory of 1436	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	89
PID 2124 wrote to memory of 2956	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	90
PID 2124 wrote to memory of 2956	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	90
PID 2124 wrote to memory of 2956	2124	fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe	90

C:\Users\Admin\AppData\Local\Temp\fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe
"C:\Users\Admin\AppData\Local\Temp\fc4662a787af50d455e51f72d20b3b0613253af06564f13cd96dfc1c6c63e76fN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
67KB

MD5
1db3ef559bae935bb470897c96a3efde

SHA1
0e28aadba5c502a22f0ca23d0a0840b5b55f5735

SHA256
d9b522a0e2fef22962742b814709190dbafc7695dd1c99ff5f67c072ccfdd295

SHA512
5572d750a45f60d700912d32caf6ff7c46db8dbd9cf22fa98f289bba5b9cf4152492294b8a668ba14707f3545c2583a4f0314f09cff1d8f6aa9f794adac082de

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
00399728dd1dcf77970f7ef00c1d5c07

SHA1
0ff228f9daaa2e3d0cad569bf12145da7cc2e0cf

SHA256
d0e1e6b7ea8f0bdb2de67ebd61f48c5bb86d619571326eb8811803e8b9b4986f

SHA512
104a4e38e6e97668dacba8db323274df8b21ba920cb147edec171f1a7566e9fc7f8c16e22a9122f75e957fc9beaff094c1aa3804c107d1af663350afd07ffa8f

Download Submit
memory/1436-13-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/1436-20-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/1436-22-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/1436-28-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/2124-0-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/2124-17-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download