urelas | 4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe
Size

109KB
MD5

0d98dfa5f54bc8fb3c6587860609bf98
SHA1

0d2f67f748e69ee62bee2f77ffc40ed984788305
SHA256

4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87
SHA512

42460ee0c20a6a9e0f8ebf716318fd91f077e75016d9475680a736b23ee7bad2010f86f941e476160003fd482d0efd8356adfc5734aa92232727fb7084b3828b
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjI9g:4tCc+/h0fmSid81L64TGVI9g

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe

Executes dropped EXE 1 IoCs

pid	Process
5116	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 5116	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	84
PID 4768 wrote to memory of 5116	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	84
PID 4768 wrote to memory of 5116	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	84
PID 4768 wrote to memory of 3028	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	85
PID 4768 wrote to memory of 3028	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	85
PID 4768 wrote to memory of 3028	4768	4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe	85

C:\Users\Admin\AppData\Local\Temp\4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe
"C:\Users\Admin\AppData\Local\Temp\4c596693a9ef3552bc3a6ab872cec32e4904f6d30e6dfc84713ec0eb21c84f87.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
109KB

MD5
8413c2381bec86df2b13bf002837bc11

SHA1
6b8a0319c6c59ef436ca734d649efd3107e5ca6a

SHA256
0c9d69e200eb7704fb0d69745e63aeb072bb935978227a11d8acd333e843c238

SHA512
a546352e602daa1b0f8823e981878ac6959dc295eeb55bf078ffd137e5fa6f83d7d10759af02b14babbfe2747e381226c90b502a57e7ec19397c422f49bdf271

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
57b7110fe53331ea1f6bf56bbfcac5bc

SHA1
da240e91fc97aa28f3700354f303d1a3f88ea7b0

SHA256
710f16b1727ed7d25b68984d385bd3ab4629aa4f27d8956550088a1827e76861

SHA512
831efd6c353dc7ecc134dc67de5196638197c02d6702891fd9501fba1bc74117830db44b48047491bfdf2d09ac229ef7a59ee232714b3e63294b5da008306883

Download Submit
memory/4768-0-0x0000000000A00000-0x0000000000A24000-memory.dmp

Filesize
144KB

Download
memory/4768-14-0x0000000000A00000-0x0000000000A24000-memory.dmp

Filesize
144KB

Download
memory/5116-12-0x0000000000500000-0x0000000000524000-memory.dmp

Filesize
144KB

Download
memory/5116-17-0x0000000000500000-0x0000000000524000-memory.dmp

Filesize
144KB

Download
memory/5116-18-0x0000000000500000-0x0000000000524000-memory.dmp

Filesize
144KB

Download