urelas | a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe
Size

57KB
MD5

bdf0b1396561fba8fb27d3f4b0b8ed41
SHA1

a4bacf1ad91282a0d85d39f695c088e8dc8d1530
SHA256

a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872
SHA512

6cbb8f4a25a67723ddb146ef0cd18ddc55599cc751624661f9b016c333dad4adfcd5148be92bd7c3b1c0a247ee14ea65c016b9f9e98364b42ecd0904f7e3ffb0
SSDEEP

1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8Ne:MOemdTd1o74qlmbbJ+x+Ikm

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe

Executes dropped EXE 1 IoCs

pid	Process
2132	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2132	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	85
PID 1208 wrote to memory of 2132	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	85
PID 1208 wrote to memory of 2132	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	85
PID 1208 wrote to memory of 5048	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	86
PID 1208 wrote to memory of 5048	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	86
PID 1208 wrote to memory of 5048	1208	a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe	86

C:\Users\Admin\AppData\Local\Temp\a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe
"C:\Users\Admin\AppData\Local\Temp\a87a888a40ed1ac3de8fcfe2528b51a2097a4a25840bc0da213083f33161f872.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
57KB

MD5
1979e05f673517f87d82bbc4ae54196c

SHA1
8ad8702ef15df00af2d36ce78cdafc8f1b58e40d

SHA256
ce0053a0a59c49c5bcac2201bee52383a112464547a164cf87cb46a6852183e5

SHA512
e40d6b4f0e0740f08ab935fbe2ae6032278a64ad71b8b9afd85fe1f97cc82db9de7027a4b7c0c804e33370ded75bcf6109e69726af1d8ce952dfa0390d79998d

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7cdc8777d33db85bc19aefb64879a7f7

SHA1
f2d494d4dfe93a05eb58513935196e8578648adf

SHA256
9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336

SHA512
34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
d7422754bbf7eadb3322464345f79c3c

SHA1
361ce840408625b507020ac9c4e8266c561ac3e6

SHA256
56d2b1f51f313d18df3b7a05d7d14d4fd7f189b050fecf1b4971095c557c179a

SHA512
99e889b4496bab4f45cff1e7e8c28a0c956cc5ecd3b24189298c446e14d6560d50876d4589b08a99c53a8e6c5663c1adb087cb0da4fe77e9c5af3d59971b2368

Download Submit
memory/1208-0-0x0000000000CF0000-0x0000000000D16000-memory.dmp

Filesize
152KB

Download
memory/1208-15-0x0000000000CF0000-0x0000000000D16000-memory.dmp

Filesize
152KB

Download
memory/2132-10-0x0000000000700000-0x0000000000726000-memory.dmp

Filesize
152KB

Download
memory/2132-18-0x0000000000700000-0x0000000000726000-memory.dmp

Filesize
152KB

Download
memory/2132-20-0x0000000000700000-0x0000000000726000-memory.dmp

Filesize
152KB

Download
memory/2132-26-0x0000000000700000-0x0000000000726000-memory.dmp

Filesize
152KB

Download