urelas | de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe
Size

62KB
MD5

235624e41182355162b9b273e1205680
SHA1

666dc4c670fe1649455a2fac736e180c4733516b
SHA256

de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504
SHA512

0fa906be6e3c50f3bb7522cd5e7e53090eeede7efc3cf57f75273a018dbdfddce52ac56dbb6b6a5d390a5d97b33e5117bafc887e68e3159c3799f44c37f98df6
SSDEEP

1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVd6F:Jo0cAthu6+FQ0JuPkd6F

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1220	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	83
PID 2652 wrote to memory of 1220	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	83
PID 2652 wrote to memory of 1220	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	83
PID 2652 wrote to memory of 1968	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	84
PID 2652 wrote to memory of 1968	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	84
PID 2652 wrote to memory of 1968	2652	de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe	84

C:\Users\Admin\AppData\Local\Temp\de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe
"C:\Users\Admin\AppData\Local\Temp\de9aa85cc6db379e1d8ca80a4522611da38f3fba63956a22747a6d360d9ec504N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
62KB

MD5
4cfc632d887a9c70cef8cc3b86bcad46

SHA1
f7a4757107fcbe53a7a871654eb57ae949f9497a

SHA256
5d6b3cdbd1b6a8c8e9ea33bd39acff578cd321f666dca748e73c558f2d99e961

SHA512
4b68b790b11c24c46ff798e72e1182d78ec051178a8766b89a10a252e16d81ee89e3d3b5155532239e050bcd30cdfafae28bd29be32ceaeabe8edf9e03140d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
657ce9e5dd337971e44dfb9cb3fbf7dd

SHA1
026734083afaa4b7d298781b26a72ac9b67ac831

SHA256
3138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472

SHA512
79aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
f284731f3e56d0693982d15b9fdbe1dd

SHA1
f75b44ee70c4083c3cb06d10d3d3f13d13720ddc

SHA256
8dd5fbeee3ddcc404bc143d57b50131b4013df4724711a6ccaefdf18205a5ba4

SHA512
bfd2dbf80a00b3be40e486b8a9f4ed9831610ca10bd078b3421b84444b69e0119d3c3559b76d9d49fb646043e2e342999c0d21d761ccfa617c3e11bb79920304

Download Submit
memory/1220-12-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/1220-21-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/1220-23-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/1220-29-0x00000000001C0000-0x00000000001E5000-memory.dmp

Filesize
148KB

Download
memory/2652-0-0x00000000000A0000-0x00000000000C5000-memory.dmp

Filesize
148KB

Download
memory/2652-18-0x00000000000A0000-0x00000000000C5000-memory.dmp

Filesize
148KB

Download