urelas | f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04

General

Target

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
Size

65KB
MD5

7b21ff621233c2d543b7df119a3dca70
SHA1

56cd210cdc0d22d11683f108ff50abbd178c342e
SHA256

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04
SHA512

04833a0eb479f874be05280a7198ed41e63e94ac5f6d3c54fe4df3100a68194537b3b41a2ace2186b1315858cb56dc071952149fb0b890f5c32d04d5191be0bc
SSDEEP

1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/j:6bQRSHpAvzyf7MzeTYj

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2756 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2676 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

pid process

2720 f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2756	cmd.exe

pid	process
2676	biudfw.exe

pid	process
2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

description	pid	process	target process
PID 2720 wrote to memory of 2676	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 2720 wrote to memory of 2676	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 2720 wrote to memory of 2676	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 2720 wrote to memory of 2676	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 2720 wrote to memory of 2756	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe
PID 2720 wrote to memory of 2756	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe
PID 2720 wrote to memory of 2756	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe
PID 2720 wrote to memory of 2756	2720	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
"C:\Users\Admin\AppData\Local\Temp\f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
65KB

MD5
387376d79e826fad556f17f31d4d6451

SHA1
70513d439176cb750b58531c423fc952e99aecd5

SHA256
2f2ed773123c1bcdccf49106972e445bf32eafba98c2dccd2948fabb88927472

SHA512
50eb316cd0613c276a04048a555325a4f5df016ce4020597d9827279619cc306aad6bfcbe78d2a22cdf099723dfe999c945c26511482c0c80c7ae6502db88455

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
efd90b3ac908d5482af367de3a82184a

SHA1
de9f01d2ed0247b7b347e55c5a09721a60147fb9

SHA256
44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d

SHA512
6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
e6bc1aaf2bd0ff5487ce9e2223955c9f

SHA1
06ec20c695a580777e5a796b0de082cf09f456c8

SHA256
db22ad13bbbac880ec611debedb44f2f5a43b20a927f1c03d1ef4bb900995a53

SHA512
6260aeaf0b4767b9740d969a53fab43a293fa2e34f833773964db1973825bce0a762394763fd0725ec21eba3bac6f34da39a8975e0fbf7277e8e72cb9ea8e9b3

Download Submit
memory/2676-19-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download
memory/2676-22-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download
memory/2676-24-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download
memory/2676-31-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download
memory/2720-0-0x00000000003C0000-0x00000000003E5000-memory.dmp

Filesize
148KB

Download
memory/2720-18-0x00000000003C0000-0x00000000003E5000-memory.dmp

Filesize
148KB

Download
memory/2720-16-0x0000000000530000-0x0000000000555000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing