urelas | 4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe
Size

109KB
MD5

0d98dfa5f54bc8fb3c6587860609bf98
SHA1

0d2f67f748e69ee62bee2f77ffc40ed984788305
SHA256

4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87
SHA512

42460ee0c20a6a9e0f8ebf716318fd91f077e75016d9475680a736b23ee7bad2010f86f941e476160003fd482d0efd8356adfc5734aa92232727fb7084b3828b
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI9g:4tCc+/h0fmSid81L64TGVI9g

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe

Executes dropped EXE 1 IoCs

pid	Process
4504	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4504	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	82
PID 3908 wrote to memory of 4504	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	82
PID 3908 wrote to memory of 4504	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	82
PID 3908 wrote to memory of 1264	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	83
PID 3908 wrote to memory of 1264	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	83
PID 3908 wrote to memory of 1264	3908	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	83

C:\Users\Admin\AppData\Local\Temp\4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe
"C:\Users\Admin\AppData\Local\Temp\4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
109KB

MD5
27fcaf7a508906908971e3c83c9bfd76

SHA1
bbfb5af5e2648f2a136323c1153b912a74ecb09c

SHA256
4688bf51f5623bea3d466effb8000ca94df33bbd5d550f2b6aa9565d012d7248

SHA512
1c7e05a480d2a323e239bb25bce5396fb11bf4c5406c092f070c354b2238c51774f3faa0c03b1d50c7bc3d4be0c6f239b9e3090089377457d9c03a8c3134f4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
57b7110fe53331ea1f6bf56bbfcac5bc

SHA1
da240e91fc97aa28f3700354f303d1a3f88ea7b0

SHA256
710f16b1727ed7d25b68984d385bd3ab4629aa4f27d8956550088a1827e76861

SHA512
831efd6c353dc7ecc134dc67de5196638197c02d6702891fd9501fba1bc74117830db44b48047491bfdf2d09ac229ef7a59ee232714b3e63294b5da008306883

Download Submit
memory/3908-0-0x0000000000A20000-0x0000000000A44000-memory.dmp

Filesize
144KB

Download
memory/3908-14-0x0000000000A20000-0x0000000000A44000-memory.dmp

Filesize
144KB

Download
memory/4504-12-0x00000000008F0000-0x0000000000914000-memory.dmp

Filesize
144KB

Download
memory/4504-17-0x00000000008F0000-0x0000000000914000-memory.dmp

Filesize
144KB

Download
memory/4504-18-0x00000000008F0000-0x0000000000914000-memory.dmp

Filesize
144KB

Download