urelas | 3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe
Size

58KB
MD5

e30124f3022f583eaca0792b61d19ea4
SHA1

f3b2d070018ca69fe6d985bc13fe4aa329d3d43d
SHA256

3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2
SHA512

21c334b42a47faabb905f386339311e935935b988ab94a5c4c40a0e13659364b128c7afd9e1a0c5f372ed36d88ddb3f118537b64cabb68e58728db3d16e28af5
SSDEEP

1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1lw:amZ+luXwy2f9LDhDlw

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe

Executes dropped EXE 1 IoCs

pid	Process
2460	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2460	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	86
PID 3828 wrote to memory of 2460	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	86
PID 3828 wrote to memory of 2460	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	86
PID 3828 wrote to memory of 32	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	87
PID 3828 wrote to memory of 32	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	87
PID 3828 wrote to memory of 32	3828	3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe	87

C:\Users\Admin\AppData\Local\Temp\3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe
"C:\Users\Admin\AppData\Local\Temp\3f1b8766aa4d7bda028f42484807f996e2069d359ecb6280dfdca2c38b8cafe2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
58KB

MD5
6b5fa5394a69845e58c4292873dc00d9

SHA1
3cb34db57c30565734b9eca6b272f2044f25700c

SHA256
5a86b280391870983c48cc88e3f057a18a68a291176a267ae77cf62da14871b9

SHA512
66a04e4c899473d1eed84d079e9cf5d4ffe59852b151e2a8533971febeddbcb9a14fbf3d507cba8ae81ba27c92524953a3713b1e59cb33f6d018ba3d125695a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
26625b4ca7658f7ba4dc7d982782323c

SHA1
574aa314998c39e683675ccf457b0305341a4aaf

SHA256
c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283

SHA512
5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
4e0ca801ea2451c715fb0b330ba32a33

SHA1
d4eb291d03edf5072b3f88ea5d63791bb00f7ccc

SHA256
204d7644522905e3c319ea25f1c48ab3d0f33a90e90929f154eeaf94e310959d

SHA512
b8883cb10e568b93703ad8efabb16ee3b02cb23efe86749fc9b62b3acfb86e5b1d0de7056c41620cf30e88d4149734a0b771bea36bcf8f529259f65471252e62

Download Submit
memory/2460-14-0x0000000000AC0000-0x0000000000AF2000-memory.dmp

Filesize
200KB

Download
memory/2460-21-0x0000000000AC0000-0x0000000000AF2000-memory.dmp

Filesize
200KB

Download
memory/2460-23-0x0000000000AC0000-0x0000000000AF2000-memory.dmp

Filesize
200KB

Download
memory/2460-30-0x0000000000AC0000-0x0000000000AF2000-memory.dmp

Filesize
200KB

Download
memory/3828-0-0x0000000000620000-0x0000000000652000-memory.dmp

Filesize
200KB

Download
memory/3828-17-0x0000000000620000-0x0000000000652000-memory.dmp

Filesize
200KB

Download