urelas | 797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63

Analysis

max time kernel
95s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe
Size

193KB
MD5

61680c917c1a19dac1b096853c2bcc5a
SHA1

16d8f43406c910483c0a4e1ea5327e0aa34058fc
SHA256

797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63
SHA512

fea54941f01c4391d6c307719f7c84fcead30a33f8ac3cc407d041969cb464ae58d6c86a1c9e5eabaa471f3d6b5fcc52be3b4d162bc63bb5f54d191a90273f07
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhA:gExhk7rh7NEOIYWlPM6r6A

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid	Process
3576	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exebiudfw.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe

description	pid	Process	procid_target
PID 3288 wrote to memory of 3576	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	84
PID 3288 wrote to memory of 3576	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	84
PID 3288 wrote to memory of 3576	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	84
PID 3288 wrote to memory of 1468	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	86
PID 3288 wrote to memory of 1468	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	86
PID 3288 wrote to memory of 1468	3288	797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe	86

C:\Users\Admin\AppData\Local\Temp\797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe
"C:\Users\Admin\AppData\Local\Temp\797863e7e81c2300c16865f8f8d3c62867df75e65a8cb648d862aa7a8b9d4b63.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
193KB

MD5
d27838af73e8eec8a3d1edaa9658efef

SHA1
d9ff636714fa6091ced0928f01273ed9b5a6527f

SHA256
5ee3828cfafbfba584d13fabfdf652c0bee1b9aae11e39db24bf6a0e5841a373

SHA512
7e6dc1c4094e1d0f843cb4af78dd05be30ea27d849be6aa169ed45c2335c6b4e0bdd42b3e8ce9a1b903df91041f0081ad6728f55ac2cde73381dff35eb26912e

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
1d0611bb97ead3fd92b0bfc8964a0dd4

SHA1
9956bfbaebb5b5d7d0b17cbe376a5e7739efb541

SHA256
3e2ac7efa69ec213edf95b542a7d34dad3c89a01971b08682f57efacec86fe83

SHA512
2cd31f644ecaf25a054aa7c742d6404a88a1c4d8490f4bde27b730924d613cbe5df3b481d320fc10414b1c68e086473dc2f220ef6f55798fd4c0e8f3bf767c7b

Download Submit
memory/3288-0-0x0000000000710000-0x0000000000744000-memory.dmp

Filesize
208KB

Download
memory/3288-14-0x0000000000710000-0x0000000000744000-memory.dmp

Filesize
208KB

Download
memory/3576-11-0x0000000000680000-0x00000000006B4000-memory.dmp

Filesize
208KB

Download
memory/3576-17-0x0000000000680000-0x00000000006B4000-memory.dmp

Filesize
208KB

Download
memory/3576-18-0x0000000000680000-0x00000000006B4000-memory.dmp

Filesize
208KB

Download