urelas | 4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe
Size

55KB
MD5

b31e33f18a671f6dcb661de3eb5da035
SHA1

6ce0726df71be8885e0918045787410d127b51de
SHA256

4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f
SHA512

f70b364a6ef8b7b0ad56e0158e05c9b27d30ff3f9e433a621888a6aa17cd6fa21ec348b9c6361149925c3b481edcc5d63e182ee28e44349efa67299dadef2d4d
SSDEEP

1536:qw788avzI+on+TqOK0cHMqtzMLvWsrupwnTf1GqT76:qwda7KVr0cHneunw16

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe

Executes dropped EXE 1 IoCs

pid	Process
840	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 840	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	88
PID 3156 wrote to memory of 840	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	88
PID 3156 wrote to memory of 840	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	88
PID 3156 wrote to memory of 1916	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	89
PID 3156 wrote to memory of 1916	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	89
PID 3156 wrote to memory of 1916	3156	4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe	89

C:\Users\Admin\AppData\Local\Temp\4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe
"C:\Users\Admin\AppData\Local\Temp\4075af41ee875cd5516543255c2bba7406652ccea2b4bae93802f8c95b9f2f9f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
4c29c1f3dd2f0c13a39e4a408ed14262

SHA1
702584be912f343308f4e88d078c3682e183f644

SHA256
978330d479a8c567a38ecc91a171cd99f2e2f204767d0739eb63e81e8a3d96f0

SHA512
b3d8de1c6062187151a41c4ff4c9ca4bd16c14add6d2ae15e46aef582ab62eb3bd783d5995b0adbdc00aaccd972c5d68f3d4b6cf652aacc418c8250e07fb7bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
0750e4580a3e9076e82bdc6ad33ba927

SHA1
b1e526b3833feda0e3b0738c6865fdac6360bf07

SHA256
74428e568204ea0d1c31570864cb96b1c2b672880f7575220957bf5fc2b24d89

SHA512
303b2cb8e644b336d7bf0892eadc84b414afdc41216719721aa0cf27fc18ecea1a2e943f07813c41d55c4166e489f89ec61a4fcead679ed3de8b323ecb42a8d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
5cfa9577e1db71a0f8bea582ced27977

SHA1
4564df90ca7662c107635beb743fa2ada0cadf0f

SHA256
f04e34c0bcc9b1d27986170736a02761ec3c297a229c001a9c476cf2c6a5e1f7

SHA512
69783177fb77467908c278523aa4712f16bf4d22e0b241ea4af2242e29e02ab8d331e7934dccd3920ea37c40c2350b6a653635154dfe5829a6c5e47cde85831b

Download Submit
memory/840-13-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/840-21-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/840-23-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/840-30-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/3156-0-0x00000000008B0000-0x00000000008E1000-memory.dmp

Filesize
196KB

Download
memory/3156-18-0x00000000008B0000-0x00000000008E1000-memory.dmp

Filesize
196KB

Download