urelas | 0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec

General

Target

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
Size

55KB
MD5

8a03214e0ffbe0906d7a2696dc168c84
SHA1

1b4df1901dd050b86e025962feb42b664c11cebd
SHA256

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec
SHA512

67cf14cc96f786b8f73e41e6dd025603fd4af7c6dd4ba0081cfdebc75faeaf35017baef207f0db678a478cc8d7fc43a250cafd9842dc64aa53d56f51603b6836
SSDEEP

768:egjKOwfkQsxi4CUWsFZzdXCHuWFpuQlBVQayBAFp1pAK4gpuK1cnPdFmfbpA9ANF:bKOjssTdFMsAX1pA6G0qm1Y8jgFzK

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

3588 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3588	biudfw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe

description	pid	process	target process
PID 2196 wrote to memory of 3588	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2196 wrote to memory of 3588	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2196 wrote to memory of 3588	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	biudfw.exe
PID 2196 wrote to memory of 852	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe
PID 2196 wrote to memory of 852	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe
PID 2196 wrote to memory of 852	2196	0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe
"C:\Users\Admin\AppData\Local\Temp\0cafeb3d70a93f5f6ca0b19aa146bae9b3696ed5d3e89600c57beffb6aebcaec.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
8196cfee4c54113ab21d1ecef6438000

SHA1
c7c79befb75788e3f3633ea8c783231adc49854e

SHA256
ff2319c706587d588312d1c5fcb6a7c91ae47470bb28f76167c3eaba1029d63e

SHA512
0484071ac414b77bec7576745ae5dbc9bc12e0bd5f1482f5352e2a879c6c49a6f977dedbf95bd92681272f8353aa14f9756c78be0e93305bf0e7f9dc8039f8bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
0dab8e4724455e250b28caddca2a54ae

SHA1
2dd0f31a87864b107ea9725c746beb7dde22c778

SHA256
0c69e36428143dd25a9164da6e1beb9ddc19422e5a1fc1af2e13e87fec99dea1

SHA512
8ea3364bfb1cda2f06436d3e094dba7495e830d8053c1e2c251128d357e574fe1f118c15a690ec2f22e3f470f10076a1b886deeb94964334761f368572f83e52

Download Submit
memory/2196-0-0x0000000000DD0000-0x0000000000E02000-memory.dmp

Filesize
200KB

Download
memory/2196-18-0x0000000000DD0000-0x0000000000E02000-memory.dmp

Filesize
200KB

Download
memory/3588-13-0x00000000007B0000-0x00000000007E2000-memory.dmp

Filesize
200KB

Download
memory/3588-22-0x00000000007B0000-0x00000000007E2000-memory.dmp

Filesize
200KB

Download
memory/3588-24-0x00000000007B0000-0x00000000007E2000-memory.dmp

Filesize
200KB

Download
memory/3588-30-0x00000000007B0000-0x00000000007E2000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads