urelas | 2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe
Size

71KB
MD5

5cc35f43952082ee1ba69f43df780768
SHA1

fa6b3e264bada2a2a43257d6618282358e8b59a8
SHA256

2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098
SHA512

91301178d59864d0bffac4ec8352bc127504744c1a7da55ac42cab11e06d362572703ca991e2480fa1348843ea9df68700e2bb30a78c96ff49aaf787298465d3
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarawE:yLAYUzmdD0sMQl7d7IuhCae7

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe

Executes dropped EXE 1 IoCs

pid	Process
4248	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4248	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	88
PID 2208 wrote to memory of 4248	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	88
PID 2208 wrote to memory of 4248	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	88
PID 2208 wrote to memory of 2036	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	89
PID 2208 wrote to memory of 2036	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	89
PID 2208 wrote to memory of 2036	2208	2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe	89

C:\Users\Admin\AppData\Local\Temp\2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe
"C:\Users\Admin\AppData\Local\Temp\2548bd07094d7332d8453d7ec85e27d37f6cdd35756c460a3471899ce759e098.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
71KB

MD5
daad5e73b552940df13402c4b097c890

SHA1
47f6b21e8f2b178427a9e33dad843e890376a652

SHA256
95075b6689c3e32cfa3bf5cbf62dbff82176e24d5fbfe4604f1063414d8b0543

SHA512
d7881a65a0588234748327b32af6d0b9896d82b24267ac9388bfc4d4f313be0f6d37ec8ea2d15d154b717bc41fa047e06a25e58cd373edb4c4b4522e549e7d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
4e1c25cc44014a62266f9dbf9111cafe

SHA1
34981f1ab5d6fc8e6d19bbffb5852a5063440259

SHA256
5dbb70dab74e729a75eb059f55efb1b4f24ce66d1a13a8bdfcb9b32d01ccaa77

SHA512
a3dd8892d913437bdc611273251a4ddc56e625ac2d6b1e63792965d301fe6a50d338dd417d8338604b047cd0e93e2501efb63c71a22be14c782a01c12a342aa4

Download Submit
memory/2208-0-0x00000000006E0000-0x0000000000707000-memory.dmp

Filesize
156KB

Download
memory/2208-18-0x00000000006E0000-0x0000000000707000-memory.dmp

Filesize
156KB

Download
memory/4248-15-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/4248-21-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/4248-23-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/4248-29-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download