urelas | 64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe
Size

62KB
MD5

b3298a5d69a7c0615b95de552b9dbdd0
SHA1

a2a1c521ac83fbd91aca41807e227f28325d350f
SHA256

64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0
SHA512

46ddc99f22fc3d02e9547dd82a9dc1f2bf6c7be77fcbd20349b018c610b0476f69c5d483b8fde9b495556d48c4ce5bdf0c12fdbfc61e2de9d079dd67ec932906
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVd:Jo0cAthu6+FQ0JuPkd

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1744	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	82
PID 4624 wrote to memory of 1744	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	82
PID 4624 wrote to memory of 1744	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	82
PID 4624 wrote to memory of 2528	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	83
PID 4624 wrote to memory of 2528	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	83
PID 4624 wrote to memory of 2528	4624	64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe	83

C:\Users\Admin\AppData\Local\Temp\64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe
"C:\Users\Admin\AppData\Local\Temp\64c2712903a277136120f5ababf2ec2c69ac044e4b7cbaf81954854927f54ea0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
62KB

MD5
f23b57870b59900b59c4c629cc32c23a

SHA1
59aeb352fec62cd4f5b65412c5c0678f8d75ac0e

SHA256
3321ef77bf80dcfdba17a1ade4e223159c4541d176ad8674a8c34add0a4d31f3

SHA512
c07cd04ca587c0c9c3fe4a1412570b4966abbe329fb2f12a1f5879326f0dcfce37b6a117ecfacb0e8463e79c762e2ae8502620a86af07ee0b316ba9b34acb8fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
9c00fb8a698af0f33927dd21005359e4

SHA1
fb0878b081f860da71df83204cd33770050a68fe

SHA256
0c778d22e2bd8054cb1746f4f6296c6b41f925519a1d8652cd9a8b5ab0fa0aae

SHA512
8b4685d9d6ba4ceebd6ce228e27297e2a4779d6ec8899aef261b9856fd9b8af505e8aed5ccf9f9d3313061979c19cba9fe58327d7a1c77a6d9b03a25d17f9a44

Download Submit
memory/1744-12-0x0000000000E40000-0x0000000000E65000-memory.dmp

Filesize
148KB

Download
memory/1744-21-0x0000000000E40000-0x0000000000E65000-memory.dmp

Filesize
148KB

Download
memory/1744-23-0x0000000000E40000-0x0000000000E65000-memory.dmp

Filesize
148KB

Download
memory/1744-30-0x0000000000E40000-0x0000000000E65000-memory.dmp

Filesize
148KB

Download
memory/4624-0-0x0000000000890000-0x00000000008B5000-memory.dmp

Filesize
148KB

Download
memory/4624-18-0x0000000000890000-0x00000000008B5000-memory.dmp

Filesize
148KB

Download