urelas | 6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe
Size

55KB
MD5

03b5b44f6577ee7c2d5f5cf45b80d1b0
SHA1

3d7601cd48017bf372fd5e8d9301e3defc85fe20
SHA256

6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085
SHA512

b5398eef8c8d0100ac45f244f653fdd3da134159aa6da49c9b9937314c7ca6629a75a3ea9bdee792c1b23d76bb2025b2c970af1b392e26b267c65d65da581f74
SSDEEP

768:egjKOwfkQsxi4CUWsFZzdXCHuWFpuQlBVQayBAFp1pAK4gpuK1cnPdFmfbpA9AN2:bKOjssTdFMsAX1pA6G0qm1Y8jgFzN

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe

Executes dropped EXE 1 IoCs

pid	Process
1000	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1000	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	89
PID 3992 wrote to memory of 1000	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	89
PID 3992 wrote to memory of 1000	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	89
PID 3992 wrote to memory of 3440	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	90
PID 3992 wrote to memory of 3440	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	90
PID 3992 wrote to memory of 3440	3992	6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe	90

C:\Users\Admin\AppData\Local\Temp\6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe
"C:\Users\Admin\AppData\Local\Temp\6a43a87733f9b0cbede5e6ebacedd6d4284b89fbf694c2729f8c2d72e22ec085N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
81cd049d5fcd12aa64d3b119d44499bc

SHA1
92fd31177c712271bab9659c3fe778149003a5c2

SHA256
7a2f65acb27b5406922b4f02386bd7b877fbbeb23fc88a3cb05a4db6ea8b7eb0

SHA512
8785213097af4c33a1d93d7f9ba082c24e9ba2e8e18fe5bf577a19f5fb70d6ce8aaeb8293a5ee04b75a364eaa80e6e3bd19fdd54cfc2c6b9b920f48eab842cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
fcbed62ce61f6e4aeca3587f0b55af05

SHA1
e42c13fb3236b9deeeea525f5b575fd9cea73c88

SHA256
86ddcf4cb767744f95b3deef0dc86e59dc76e172aab73e97ac8712d80e267024

SHA512
c74df23b8994b7819cbf6539bbdafda308632cb8f2517dedccbae73f5e2d6a1d02c99f99bae1143460f1ce2276d953f76aabc05a585f3eac77a124f70f7468a0

Download Submit
memory/1000-13-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1000-20-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1000-22-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1000-28-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/3992-0-0x0000000000BB0000-0x0000000000BE2000-memory.dmp

Filesize
200KB

Download
memory/3992-17-0x0000000000BB0000-0x0000000000BE2000-memory.dmp

Filesize
200KB

Download