urelas | 5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe
Size

186KB
MD5

e911dbcfb35e484339e586daf7f7c5c0
SHA1

4562addd7d2964b582a2b9157eee93033feaf309
SHA256

5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451f
SHA512

7f43278aa5d59e180d75095233b2d130691d91dda3741809488bd65adb2822de8d7e72eadb5b8d3f4d3f3433df5347c5f5e5e047a14f8c0ae3746e90bd505fd7
SSDEEP

3072:1tpCP+/oGvWSldHy64T9fQmZ+luXwy2f9LDhDAl:Tp+IrvNyhhh4yfWvO

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe

Executes dropped EXE 1 IoCs

pid	Process
3988	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3988	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	89
PID 1116 wrote to memory of 3988	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	89
PID 1116 wrote to memory of 3988	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	89
PID 1116 wrote to memory of 4580	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	90
PID 1116 wrote to memory of 4580	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	90
PID 1116 wrote to memory of 4580	1116	5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe	90

C:\Users\Admin\AppData\Local\Temp\5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe
"C:\Users\Admin\AppData\Local\Temp\5cc319ed0cb07c04e03b113af0a6570dba3b8d3b4afae49649838c85b804451fN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
186KB

MD5
cc81598929a2ffad5ffe9ed41602dfc6

SHA1
9a23c8a1a27fadf134233ff0bf363419426777b6

SHA256
fc4d7881fd04b9df45a5f05ecd344acdbe2cbf1dedec2b22f1eb5fd5b18b8065

SHA512
9697e7c932c07b9e2871a546eab867f021674b5b7662eb5724cbfbc76974cf7c3bc678f3ab4df858a43658a9d31802bd82f601f574832e2bf2dd50baaf44bb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
26625b4ca7658f7ba4dc7d982782323c

SHA1
574aa314998c39e683675ccf457b0305341a4aaf

SHA256
c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283

SHA512
5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
4b24a57df48cf87023b18a7ca8b1e8d8

SHA1
5e461b738670613af2ad336882446440b5d15561

SHA256
4a4eb1b0c3eaa33b82c69531191315147d258002ceaab5ff1b66bafe64bdf82b

SHA512
5408be0e97d76428f82779a1e56cf51cd688c4fc231263d3a8e44e9ef58aed12d79bfa52dbeb1fc57e2c3979c79a392a48a608c2f53d97c7ea0408019a1a2268

Download Submit
memory/1116-0-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1116-17-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/3988-13-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

Filesize
200KB

Download
memory/3988-20-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

Filesize
200KB

Download
memory/3988-21-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

Filesize
200KB

Download