urelas | 163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61

General

Target

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
Size

55KB
MD5

0380f71ecd0968fbf61c40ad60c4aef1
SHA1

d39bc1b54a8cad59cf8a8bd2789834204a931997
SHA256

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61
SHA512

46c92b30c384efd00c0751f0c88649e96963879eea98fdb60cd635f0fcb94c280de78f8c4eca520684f6fccf9f1fde8f0b1dc3e20f873679e5087ad2be65981c
SSDEEP

1536:qw788avzI+on+TqOK0cHMqtzMLvWsrupwnTf1GqT7u:qwda7KVr0cHneunw1u

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2256 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2516 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe

pid process

2480 163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2256	cmd.exe

pid	process
2516	biudfw.exe

pid	process
2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe

description	pid	process	target process
PID 2480 wrote to memory of 2516	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	biudfw.exe
PID 2480 wrote to memory of 2516	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	biudfw.exe
PID 2480 wrote to memory of 2516	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	biudfw.exe
PID 2480 wrote to memory of 2516	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	biudfw.exe
PID 2480 wrote to memory of 2256	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	cmd.exe
PID 2480 wrote to memory of 2256	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	cmd.exe
PID 2480 wrote to memory of 2256	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	cmd.exe
PID 2480 wrote to memory of 2256	2480	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
"C:\Users\Admin\AppData\Local\Temp\163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
0750e4580a3e9076e82bdc6ad33ba927

SHA1
b1e526b3833feda0e3b0738c6865fdac6360bf07

SHA256
74428e568204ea0d1c31570864cb96b1c2b672880f7575220957bf5fc2b24d89

SHA512
303b2cb8e644b336d7bf0892eadc84b414afdc41216719721aa0cf27fc18ecea1a2e943f07813c41d55c4166e489f89ec61a4fcead679ed3de8b323ecb42a8d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
761e7bf8d17914b8a6167c405af50832

SHA1
1d5b173d83229c31e234fe4144af3186bee401a0

SHA256
f9146ae7477b3713f41ba512cfb8dfc820af0b1973cecbc87040e9c5924bea19

SHA512
cd9943cb2868f12cdd8280f0bb3a48bde7311201e99d1ff4c758062f6ccaeb9beef610ba09d8d25cac3dd2175682df8af37410a5bfd03d45926d50a960695598

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
b4695202b3c494a2bea7c5a78556cae5

SHA1
fad7ee7762211103097109438b6f4b688a58bc94

SHA256
b4231bc1052c00a2d0afca221523283a54dec9570128fa2f20310fe0985c5ffd

SHA512
b40499a5cc2d3916f0986880500d05ddf42e77cefcdd34b808504a68a0df91573545c17ff3efdd3bf15c1b6f261740978fcb4835bae9eb73a47db6f85570bcbb

Download Submit
memory/2480-0-0x00000000011B0000-0x00000000011E1000-memory.dmp

Filesize
196KB

Download
memory/2480-6-0x00000000003D0000-0x0000000000401000-memory.dmp

Filesize
196KB

Download
memory/2480-19-0x00000000011B0000-0x00000000011E1000-memory.dmp

Filesize
196KB

Download
memory/2516-10-0x0000000000300000-0x0000000000331000-memory.dmp

Filesize
196KB

Download
memory/2516-22-0x0000000000300000-0x0000000000331000-memory.dmp

Filesize
196KB

Download
memory/2516-24-0x0000000000300000-0x0000000000331000-memory.dmp

Filesize
196KB

Download
memory/2516-31-0x0000000000300000-0x0000000000331000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing