urelas | 1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe
Size

68KB
MD5

209c290527929d775894785ee19232e8
SHA1

d4377346fa464bb497cec55748d96fd6a2cff015
SHA256

1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab
SHA512

5b74f3a9b55f9be4153ac0d0f1bb40c53ba67103e1215e793d3a4912aeb1c028a8b5e5b1ca541fcb37c50396349a45aaa78ddc9d0a33b9e664f8987156191bd6
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOrG:l//AjMp+u2onejH2PeEG

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2004	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	87
PID 1996 wrote to memory of 2004	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	87
PID 1996 wrote to memory of 2004	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	87
PID 1996 wrote to memory of 2420	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	88
PID 1996 wrote to memory of 2420	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	88
PID 1996 wrote to memory of 2420	1996	1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe	88

C:\Users\Admin\AppData\Local\Temp\1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe
"C:\Users\Admin\AppData\Local\Temp\1174aece1d348e3403e13330b647d34c11905f3420bb35d1cb91b47799240bab.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
51510d5005055c62bba77c1e01841dc0

SHA1
9a3db9092846e3df0cb0708bdcdd84a26869a8b6

SHA256
5dec5fd678d7c271add130aebaa47aaed8dc2f8a985d339be499da1c6b44ed4f

SHA512
1c53ad17eb551c2b09eca90cab655e39f3cc11c46bd3e830cce2b37780e51378fcd2e0445aea1c3177cd8f8927c0eaee3b13abff6a47d203d3bcab1871ed5337

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
93c80a1a4e8acaf2d508a84e72e5e49f

SHA1
264b2d1e1b5d110d9443680effebd386b0e5d302

SHA256
2b904911274a9c6289e8069264c483b4d0fc2a3ce7fc0bb460c2dc4221c664a3

SHA512
8fcdec2e970b771dd084466c7c3dcacb9cb60bfd06f16e7d50aba316a4346cfdf00c71fc3be2de72d6e724e69a2f6994c47261598cb964b3843495885a867eba

Download Submit
memory/1996-0-0x0000000000E90000-0x0000000000EB8000-memory.dmp

Filesize
160KB

Download
memory/1996-18-0x0000000000E90000-0x0000000000EB8000-memory.dmp

Filesize
160KB

Download
memory/2004-15-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download
memory/2004-21-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download
memory/2004-23-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download
memory/2004-30-0x0000000000920000-0x0000000000948000-memory.dmp

Filesize
160KB

Download