urelas | 163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
Size

55KB
MD5

0380f71ecd0968fbf61c40ad60c4aef1
SHA1

d39bc1b54a8cad59cf8a8bd2789834204a931997
SHA256

163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61
SHA512

46c92b30c384efd00c0751f0c88649e96963879eea98fdb60cd635f0fcb94c280de78f8c4eca520684f6fccf9f1fde8f0b1dc3e20f873679e5087ad2be65981c
SSDEEP

1536:qw788avzI+on+TqOK0cHMqtzMLvWsrupwnTf1GqT7u:qwda7KVr0cHneunw1u

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe

Executes dropped EXE 1 IoCs

pid	Process
5048	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 5048	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	88
PID 3224 wrote to memory of 5048	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	88
PID 3224 wrote to memory of 5048	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	88
PID 3224 wrote to memory of 3244	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	89
PID 3224 wrote to memory of 3244	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	89
PID 3224 wrote to memory of 3244	3224	163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe	89

C:\Users\Admin\AppData\Local\Temp\163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe
"C:\Users\Admin\AppData\Local\Temp\163e01454cde70539009b236175d4b9a6814732161042c8cd78d0c0c14a2ca61.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
c9f1d1b08bfcc1b90a099d0dc21e39f3

SHA1
51f2a283bb956b08261181fb2fb00a24cbd86da6

SHA256
5c523a6f5e97739a6920851adaeca63ab288be9e666f4021d456a5f7c5fe3f8b

SHA512
1400666c3fcc2d556213b994e3bd63e343e5c889cae87060e71273e48cab9c6e3213d008089425f21b96f97da5d3e173bf2a580b73cf89cbfd4e51283667978f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
0750e4580a3e9076e82bdc6ad33ba927

SHA1
b1e526b3833feda0e3b0738c6865fdac6360bf07

SHA256
74428e568204ea0d1c31570864cb96b1c2b672880f7575220957bf5fc2b24d89

SHA512
303b2cb8e644b336d7bf0892eadc84b414afdc41216719721aa0cf27fc18ecea1a2e943f07813c41d55c4166e489f89ec61a4fcead679ed3de8b323ecb42a8d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
761e7bf8d17914b8a6167c405af50832

SHA1
1d5b173d83229c31e234fe4144af3186bee401a0

SHA256
f9146ae7477b3713f41ba512cfb8dfc820af0b1973cecbc87040e9c5924bea19

SHA512
cd9943cb2868f12cdd8280f0bb3a48bde7311201e99d1ff4c758062f6ccaeb9beef610ba09d8d25cac3dd2175682df8af37410a5bfd03d45926d50a960695598

Download Submit
memory/3224-0-0x00000000005C0000-0x00000000005F1000-memory.dmp

Filesize
196KB

Download
memory/3224-18-0x00000000005C0000-0x00000000005F1000-memory.dmp

Filesize
196KB

Download
memory/5048-13-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Filesize
196KB

Download
memory/5048-21-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Filesize
196KB

Download
memory/5048-23-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Filesize
196KB

Download
memory/5048-30-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Filesize
196KB

Download