urelas | f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04

General

Target

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
Size

65KB
MD5

7b21ff621233c2d543b7df119a3dca70
SHA1

56cd210cdc0d22d11683f108ff50abbd178c342e
SHA256

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04
SHA512

04833a0eb479f874be05280a7198ed41e63e94ac5f6d3c54fe4df3100a68194537b3b41a2ace2186b1315858cb56dc071952149fb0b890f5c32d04d5191be0bc
SSDEEP

1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/j:6bQRSHpAvzyf7MzeTYj

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

4756 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4756	biudfw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exebiudfw.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe

description	pid	process	target process
PID 4324 wrote to memory of 4756	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 4324 wrote to memory of 4756	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 4324 wrote to memory of 4756	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	biudfw.exe
PID 4324 wrote to memory of 1004	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe
PID 4324 wrote to memory of 1004	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe
PID 4324 wrote to memory of 1004	4324	f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe
"C:\Users\Admin\AppData\Local\Temp\f485252fe6ce56b04634ae86940df732cb2eb6b2f8dcddc485654bb9d2e79b04N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
65KB

MD5
f26b64215ace5b3a1d2ab5c4dcb15ea7

SHA1
3dde1e4312a52e7cdc7e5e53c74957e3d594b722

SHA256
b4f1e1d7bf3987c54441fb1d29738038be4d1068d7c0b8aaf70f95bde855b718

SHA512
65368201a05d8cf883828122ff2799fcb6f1a12f8dc1fa2b204e4e4c4030655398c7920ec03ef7737750fffafe4d98cad66fc653a2cd394a1aed8b529890db1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
efd90b3ac908d5482af367de3a82184a

SHA1
de9f01d2ed0247b7b347e55c5a09721a60147fb9

SHA256
44f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d

SHA512
6e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
e6bc1aaf2bd0ff5487ce9e2223955c9f

SHA1
06ec20c695a580777e5a796b0de082cf09f456c8

SHA256
db22ad13bbbac880ec611debedb44f2f5a43b20a927f1c03d1ef4bb900995a53

SHA512
6260aeaf0b4767b9740d969a53fab43a293fa2e34f833773964db1973825bce0a762394763fd0725ec21eba3bac6f34da39a8975e0fbf7277e8e72cb9ea8e9b3

Download Submit
memory/4324-0-0x00000000005D0000-0x00000000005F5000-memory.dmp

Filesize
148KB

Download
memory/4324-18-0x00000000005D0000-0x00000000005F5000-memory.dmp

Filesize
148KB

Download
memory/4756-15-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/4756-21-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/4756-23-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download
memory/4756-29-0x0000000000170000-0x0000000000195000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads