urelas | f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec

General

Target

f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe
Size

62KB
MD5

d0cf87996bbfa111dd816d493379290b
SHA1

92664a944204ce43311463b02560c3497e59f239
SHA256

f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec
SHA512

93a3955f145a59657caa7044f28ff6c72d29c20fdb877e2dea3b15b276f7184a1726208e5b1a0667d3e58b47c6c93346ae4fbcc35811845e2e8feac24d3decdf
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVF:Jo0cAthu6+FQ0JuPkF

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2804 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2672 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe

pid process

2756 f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2804	cmd.exe

pid	process
2672	biudfw.exe

pid	process
2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exef6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exebiudfw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe

description	pid	process	target process
PID 2756 wrote to memory of 2672	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	biudfw.exe
PID 2756 wrote to memory of 2672	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	biudfw.exe
PID 2756 wrote to memory of 2672	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	biudfw.exe
PID 2756 wrote to memory of 2672	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	biudfw.exe
PID 2756 wrote to memory of 2804	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	cmd.exe
PID 2756 wrote to memory of 2804	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	cmd.exe
PID 2756 wrote to memory of 2804	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	cmd.exe
PID 2756 wrote to memory of 2804	2756	f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe
"C:\Users\Admin\AppData\Local\Temp\f6485af85c764dfdfc7fced0cb1d7cdcb34265e604097ac299744959399857ec.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
ecea09bef82756713f41af2ac62361f2

SHA1
23b4ce52bd1eaf994dbeb4429caa112f4ad6ceb9

SHA256
056267720d908ebcc6291a3543709f6be8b56a04ddd41ac5577cc3160898a9a1

SHA512
05d648cbc5ddee0c7de31f8222f5f81cbde7dbc10ad7c1e9841b22cc59a9f62d599b337196dacdc4ce669ed3ee08a935ea78fe664af01d27bb2728b3147514a2

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
62KB

MD5
d4ccddc0e8f3323c4b96c0fa586ea55b

SHA1
1b002078ee55808ce8aeba1499e09b2c32a9b856

SHA256
0ee3755298d0024ff191d3836224737dddfae885a4098f29e582b012e1df5a02

SHA512
4e1459f628b47be9bece26d7dba8950b84055a0c7a4ef84baa1092c5f143c5c5e3294cf0d21dd49b3cbceda6a826f00a86ed9b274da71ab88fba237b7ea40199

Download Submit
memory/2672-17-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2672-21-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2672-23-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2672-30-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2756-0-0x00000000008A0000-0x00000000008C5000-memory.dmp

Filesize
148KB

Download
memory/2756-16-0x0000000000390000-0x00000000003B5000-memory.dmp

Filesize
148KB

Download
memory/2756-18-0x00000000008A0000-0x00000000008C5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing