urelas | 0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec

General

Target

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
Size

55KB
MD5

8a03214e0ffbe0906d7a2696dc168c84
SHA1

1b4df1901dd050b86e025962feb42b664c11cebd
SHA256

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec
SHA512

67cf14cc96f786b8f73e41e6dd025603fd4af7c6dd4ba0081cfdebc75faeaf35017baef207f0db678a478cc8d7fc43a250cafd9842dc64aa53d56f51603b6836
SSDEEP

768:egjKOwfkQsxi4CUWsFZzdXCHuWFpuQlBVQayBAFp1pAK4gpuK1cnPdFmfbpA9ANF:bKOjssTdFMsAX1pA6G0qm1Y8jgFzK

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2796 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2760 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

pid process

2872 0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2796	cmd.exe

pid	process
2760	biudfw.exe

pid	process
2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

description	pid	process	target process
PID 2872 wrote to memory of 2760	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2872 wrote to memory of 2760	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2872 wrote to memory of 2760	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2872 wrote to memory of 2760	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2872 wrote to memory of 2796	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe
PID 2872 wrote to memory of 2796	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe
PID 2872 wrote to memory of 2796	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe
PID 2872 wrote to memory of 2796	2872	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
"C:\Users\Admin\AppData\Local\Temp\0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
0dab8e4724455e250b28caddca2a54ae

SHA1
2dd0f31a87864b107ea9725c746beb7dde22c778

SHA256
0c69e36428143dd25a9164da6e1beb9ddc19422e5a1fc1af2e13e87fec99dea1

SHA512
8ea3364bfb1cda2f06436d3e094dba7495e830d8053c1e2c251128d357e574fe1f118c15a690ec2f22e3f470f10076a1b886deeb94964334761f368572f83e52

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
9c54e6b297592b725801bc835f4088c3

SHA1
460c97fe471b95f5e9df677cb336fc22b400a7ab

SHA256
82f8beeb4be2032fdcac69385c0908264a9b7ddbcedc76434adfaf50da866345

SHA512
eb79fd6fd2de75b10802cfa28b984d3502b5edbdbcc37449e2ad61fd0bfd949ff6ca78cb5ff97b89736004422491694bbc408544aa00b87eff8be848ba017d52

Download Submit
memory/2760-10-0x0000000000C30000-0x0000000000C62000-memory.dmp

Filesize
200KB

Download
memory/2760-22-0x0000000000C30000-0x0000000000C62000-memory.dmp

Filesize
200KB

Download
memory/2760-24-0x0000000000C30000-0x0000000000C62000-memory.dmp

Filesize
200KB

Download
memory/2760-30-0x0000000000C30000-0x0000000000C62000-memory.dmp

Filesize
200KB

Download
memory/2872-0-0x00000000010C0000-0x00000000010F2000-memory.dmp

Filesize
200KB

Download
memory/2872-6-0x0000000000680000-0x00000000006B2000-memory.dmp

Filesize
200KB

Download
memory/2872-19-0x00000000010C0000-0x00000000010F2000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing