urelas | d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d

Analysis

max time kernel
60s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
Size

57KB
MD5

7f987b52648a3805a0a48388fe18bfce
SHA1

8549fd4aff18239c3036cb402e18b096c6800465
SHA256

d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d
SHA512

b351d0ad6f826e6ae25796712c70cab59daf76a7ceb7bf4023e016c41daab4fa380c3a1e99b9d77ce39cb2ea3c797f311966a1312d522d2636a29a6bee593db2
SSDEEP

1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8Dc:MOemdTd1o74qlmbbJ+x+Ikpc

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2988	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	83
PID 4396 wrote to memory of 2988	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	83
PID 4396 wrote to memory of 2988	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	83
PID 4396 wrote to memory of 1740	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84
PID 4396 wrote to memory of 1740	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84
PID 4396 wrote to memory of 1740	4396	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84

C:\Users\Admin\AppData\Local\Temp\d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
"C:\Users\Admin\AppData\Local\Temp\d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
57KB

MD5
898f3079af500bff2b2a49033c2482cf

SHA1
54029e4e4c837e14bb167235137fbdc4706eaecb

SHA256
6563bb99bddcd7f3f02fce9daef29aa3d511143d5937d6262b24b26b7a7414e7

SHA512
bea98fdb21997e5884219238811ab370336513f9a9f115d4af888189ccdd45d5a9600a190351b47e1636e35632c784fa15f825bbda3b7d36083c79d1f7756a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7cdc8777d33db85bc19aefb64879a7f7

SHA1
f2d494d4dfe93a05eb58513935196e8578648adf

SHA256
9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336

SHA512
34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
9a13f6100e57f12ce71840df339791df

SHA1
3b8ebd61559ec966199ef918c82be1c32d412305

SHA256
f88f60e7aa07e4662e7d1fcf3f6280f18e38b2ca64bae380662a47b098680a4e

SHA512
71a8945ce0033b401c35bcd124755d156e05b0d5b190e629d970c5dc3850100f5acbc3096f6788c24cc99cc6b498eb0cc4afb7907dc49b2f2b9b6d911331c29d

Download Submit
memory/2988-12-0x00000000001E0000-0x0000000000206000-memory.dmp

Filesize
152KB

Download
memory/2988-17-0x00000000001E0000-0x0000000000206000-memory.dmp

Filesize
152KB

Download
memory/2988-19-0x00000000001E0000-0x0000000000206000-memory.dmp

Filesize
152KB

Download
memory/4396-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4396-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download