urelas | adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Size

155KB
MD5

91b007423dd441899daee35f6beb1d00
SHA1

e69066fc5f71efdace9ce2bfd14a6c7154141562
SHA256

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8
SHA512

72a236248d283667b59063012ed7067d3733986907492ca8a12d1fda7a53b8bbc073640b22516a6f288afc723209bc6fcb6d5225488dad08f49d1d0b3de1f44f
SSDEEP

3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2Oe3:Nt2vsx+AV4LfLOi

Score

10^/10

urelas discovery trojan

Malware Config

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3044 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2460 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

pid process

2348 adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3044	cmd.exe

pid	process
2460	biudfw.exe

pid	process
2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe

description	pid	process	target process
PID 2348 wrote to memory of 2460	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2348 wrote to memory of 2460	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2348 wrote to memory of 2460	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2348 wrote to memory of 2460	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	biudfw.exe
PID 2348 wrote to memory of 3044	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe
PID 2348 wrote to memory of 3044	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe
PID 2348 wrote to memory of 3044	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe
PID 2348 wrote to memory of 3044	2348	adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe
"C:\Users\Admin\AppData\Local\Temp\adf967410347076164af05ae7ab372b33a398c1ea45fbcb60c8af73a707f75d8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2930c042c9ee5e07f321f2134a0c7edc

SHA1
ee39f41eaf6ce3c8d917a89e65959414ae0088e6

SHA256
a328475bbb730da292b83ed6cabbdbfc0616f042296f0c6fa356c5368ffc1309

SHA512
2da91d5effc116d8c8661c2a99f1d9c2aaffda0f776551dc7ad1911fdb2765591e5b441b9a1fe0090bcda8ed24d180b563ed2c127676cf1de40001e4b15b5506

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
ae52a6d1c87e1427d3c685a79d95d16d

SHA1
5f8867cf454d76c245f386c312764f8242ff0b61

SHA256
1b84d32bf2f70071e80700e0a0531aa9cc1bb3bb92a24c83ba8b9ac9d49e9994

SHA512
d86060cdfa005a1b11625fdee16d246036d2ccfe3913b0b59dec14ec1b9e9d88459a070a33743092ba0cd47d0b57039f73d07b6d0e120d35300ab9cc8347fccc

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
155KB

MD5
c687bcfede1a7e712f9effc5aeea26e2

SHA1
bc4875ad55bbe0ea6aa1fcb99dde2b2d676da38b

SHA256
8f9e69f99b2909ce3f998a0436797d74903558fce41a5b39f026a4c1047826d6

SHA512
7f88939f8c33818823bb69862f8bc986472e2a727f9643a7f2a1fe693a629e939a09f33d22f7a7bf148bd28fde4bdf8ff6d38b656339ec1e98dd1cdb780158d1

Download Submit