urelas | 2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f

Analysis

max time kernel
95s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe
Size

60KB
MD5

3f979d588b61caf650a831b6a7121277
SHA1

52593a24343bd74093ec3ca8570296d48f64d0b0
SHA256

2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f
SHA512

a4c9acfba4f6583fc4df2c9e39813ec93acf0aacbe3b8f51d869389b431d2d817415f04048b23ee457050a7deccc985b3ebb5f53c50673f489adbfe28f8d1cae
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP4:nK0GjMeQG3iaQREuVZ6ro29p4YxbKda8

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe

Executes dropped EXE 1 IoCs

pid	Process
5000	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 5000	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	84
PID 2448 wrote to memory of 5000	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	84
PID 2448 wrote to memory of 5000	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	84
PID 2448 wrote to memory of 2508	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	85
PID 2448 wrote to memory of 2508	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	85
PID 2448 wrote to memory of 2508	2448	2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe	85

C:\Users\Admin\AppData\Local\Temp\2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe
"C:\Users\Admin\AppData\Local\Temp\2bca31dbe6ea2506dedacf67e85ade3d1f0676b42805168c6aa415ec3d32eb7f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
f9a40d38c2dd9a88aa8cbdb145c3eb8d

SHA1
ea46b5a547f8269ef1ba141e9092db6510a921c4

SHA256
156e80568815c7b18516117d695be3585b8157b5a5b3b100f4aff591c84e133e

SHA512
916615b332599d034af707488c10f0c0ff8a66cb73230d5a649c873c1bfd9025af773b3370cd7dd3e4dc0c3239fe7381c3926eeee42e032e5f541335355fb5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c97c27ba49aa43d33ebab0d20f18416e

SHA1
819636f6d2e4b7ccc873fcbc29790d05c88e8846

SHA256
6f2941d5f45ab8a570693800ab7bcbda3ee7f1a3c49346635efd33eb5392afe5

SHA512
8148cbb145df642ee794e714c16e466c5d7d837f26ffea2c9f320d1832d54add88c6c99ba5c8e32101421354c1a974872ea30e5225b8c73cc42f7b0b3a0e6720

Download Submit
memory/2448-0-0x0000000000F60000-0x0000000000F95000-memory.dmp

Filesize
212KB

Download
memory/2448-15-0x0000000000F60000-0x0000000000F95000-memory.dmp

Filesize
212KB

Download
memory/5000-12-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/5000-18-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/5000-20-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/5000-27-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download