urelas | 13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58

Analysis

max time kernel
94s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe
Size

60KB
MD5

8cb74123377be1c526114d6ff7f70574
SHA1

36c94c8c84e469d201eb4f8430ae3db0f8324ca5
SHA256

13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58
SHA512

02204f42d0ff0f24c810960bdb5a3eb8cca834aa7d3a20c2ddd033bf8721fac2a4544ec3e07f9d3334d85284abf4a4e7dc81cf33b1c5f4cf84ea79c48c3d2a72
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPy:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd5

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe

Executes dropped EXE 1 IoCs

pid	Process
228	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 228	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	84
PID 2516 wrote to memory of 228	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	84
PID 2516 wrote to memory of 228	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	84
PID 2516 wrote to memory of 4860	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	85
PID 2516 wrote to memory of 4860	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	85
PID 2516 wrote to memory of 4860	2516	13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe	85

C:\Users\Admin\AppData\Local\Temp\13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe
"C:\Users\Admin\AppData\Local\Temp\13178d908d932b95e3415ca544a54f950d90b98859714d75f23b3c83e1216b58.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
e3509c254e108b79310d357299bdb469

SHA1
0c53863fd832511ab180bcd3b0434b770d2168f3

SHA256
526c7c50e6620e16d665c2702c547e19965952fe3692a4e83b3a14f185cf8dfe

SHA512
6e40f15608e878ddecdb5e386854d7b7adb9721afe929bda7a7139effe3ee76234904c548f683250043bf73c17eef0292a6a59cabeb78b389190de7a212f2359

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
734d693a46cc4622896e3733ffcdf91c

SHA1
61578897ae53476df73a8859218dfd2a08ce504b

SHA256
3bbb674fad3415684f054bb39ae268b98b0870f4438d56877547cd9977bd6267

SHA512
056989d8ef0b6f345c9c1cb91a35b5165b6f49289165cc6613074b1f78ec6ed459dbac3724c189763900b33b0c9c76ddfdd5177c2a9500d222c3966e45e54bf1

Download Submit
memory/228-13-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/228-19-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/228-21-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/228-27-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2516-0-0x0000000000260000-0x0000000000295000-memory.dmp

Filesize
212KB

Download
memory/2516-15-0x0000000000260000-0x0000000000295000-memory.dmp

Filesize
212KB

Download