urelas | d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004c

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe
Size

67KB
MD5

f1ba7e7daa26e1a542944395df534770
SHA1

d65578addcab5f360ee4cc3e18071c4ff48b4c65
SHA256

d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004c
SHA512

0c1ec46a3a521c4e8d2114efef7afaa501a8d42b07f7580716df712ab7d13fe664e7bf983b8858579f5f120649682a8c6824cc712858743764053ca6e3216f3c
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCare4:yLAYUzmdD0sMQl7d7IuhCai4

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2848	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	87
PID 4264 wrote to memory of 2848	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	87
PID 4264 wrote to memory of 2848	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	87
PID 4264 wrote to memory of 408	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	88
PID 4264 wrote to memory of 408	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	88
PID 4264 wrote to memory of 408	4264	d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe	88

C:\Users\Admin\AppData\Local\Temp\d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe
"C:\Users\Admin\AppData\Local\Temp\d5427dae893551cfc421e02625959ca41364913b8027e563ed09e12949f6004cN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
67KB

MD5
68e356fd613f7c7ff2cb76dddeede0bd

SHA1
02e8b3a60d91a0173b174389aaf2006dc25d89cf

SHA256
6c6e5df48b8ee80571b10f242d741416e7f5f7636c3da6f3feb1093bd8b508d8

SHA512
dfe90a854190dea46ff81aa4d0e2f69d2a9aa6812743a55d935036906548072c4c54950f88c6de3404eacbcf6c91714fb14916fb49c8177306193c7ca2a75645

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
7f300d65c60a00ac027dfa759dfbf9ae

SHA1
4bc9eed9023235540898ac067c8fc8ebb1f199e0

SHA256
5335fa88670a427649aba9e71c5847763005510d71afb6c93c90c1ea7863c51c

SHA512
077b1db3fc084c2ba91a4ff3cf503c4e377f113da6f9a6f888015f0e0fc8b5c07d29496fcdd80639eaf02a1e8b8286cd157fabf46563761e2e9c2bc0b13275bb

Download Submit
memory/2848-13-0x0000000000F90000-0x0000000000FB7000-memory.dmp

Filesize
156KB

Download
memory/2848-21-0x0000000000F90000-0x0000000000FB7000-memory.dmp

Filesize
156KB

Download
memory/2848-23-0x0000000000F90000-0x0000000000FB7000-memory.dmp

Filesize
156KB

Download
memory/2848-29-0x0000000000F90000-0x0000000000FB7000-memory.dmp

Filesize
156KB

Download
memory/4264-0-0x0000000000D50000-0x0000000000D77000-memory.dmp

Filesize
156KB

Download
memory/4264-18-0x0000000000D50000-0x0000000000D77000-memory.dmp

Filesize
156KB

Download