urelas | ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39

Analysis

max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe
Size

169KB
MD5

8ca738322d9938b6d126985f167a4fc0
SHA1

1c66ba9c7db6706a869716a7359323eca3e144f8
SHA256

ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39
SHA512

8ccd05e10f18aa3c2b85111d095be6efb3c205fc414480a19b9d8889392583a7ceb65c73586593bb700c09975d0c023fc279017b42f4cff1d89bfbfae3b0a987
SSDEEP

3072:yp56zRJ83+OJ7NoGvdwWy6k04yW/KR0Yx4BXPO:yOzRWu27dlOd5/YWVm

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe

Executes dropped EXE 1 IoCs

pid	Process
2820	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2820	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	88
PID 3172 wrote to memory of 2820	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	88
PID 3172 wrote to memory of 2820	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	88
PID 3172 wrote to memory of 3052	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	89
PID 3172 wrote to memory of 3052	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	89
PID 3172 wrote to memory of 3052	3172	ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe	89

C:\Users\Admin\AppData\Local\Temp\ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe
"C:\Users\Admin\AppData\Local\Temp\ced45d6a3c829dfb89d06f75602f1023b930a028e0bf806ae3d29158cc8f8e39N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
169KB

MD5
9632bb4a218dc62d2494466a7f65eecd

SHA1
ff0ad71dd72a6e1e669b1524c92cf4e8738f3ab6

SHA256
ba8e3a10c36688b70cbeefee43c26817daf6861277d344b851dc9de4d0ea0d8f

SHA512
ffcc29d6c6b24993f2a59870b987667da9336ea31f8284479b6af0bc99a871af8c80b006b61743e3c42ea6328ee8325250ff98f2433a441f5efdde79c9143316

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
ac5e84ed8031d66a9fcd5e472ba8091b

SHA1
06303add604104d6abbb69458f89773c066b470c

SHA256
3a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5

SHA512
7bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
b17b1c45541f3fb3e4154a5932ad2488

SHA1
868538fc2862621fd4c0bebd52992397643117cf

SHA256
b33dc30f52a0a2a05cf92ff2488111cd16024c1a3c7e2fa78ddbb70ef9ab160b

SHA512
b0caf2226d8cff8219e1345d5a607771f3c120054720388a197103e883923e0bd2be26e455b4950ac6e4a641f898e36f53eb732db2f7dabd71f359d5b032cb3f

Download Submit
memory/2820-15-0x00000000005B0000-0x00000000005DB000-memory.dmp

Filesize
172KB

Download
memory/2820-20-0x00000000005B0000-0x00000000005DB000-memory.dmp

Filesize
172KB

Download
memory/2820-21-0x00000000005B0000-0x00000000005DB000-memory.dmp

Filesize
172KB

Download
memory/3172-0-0x00000000002E0000-0x000000000030B000-memory.dmp

Filesize
172KB

Download
memory/3172-17-0x00000000002E0000-0x000000000030B000-memory.dmp

Filesize
172KB

Download