urelas | d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d

Analysis

max time kernel
94s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
Size

57KB
MD5

7f987b52648a3805a0a48388fe18bfce
SHA1

8549fd4aff18239c3036cb402e18b096c6800465
SHA256

d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d
SHA512

b351d0ad6f826e6ae25796712c70cab59daf76a7ceb7bf4023e016c41daab4fa380c3a1e99b9d77ce39cb2ea3c797f311966a1312d522d2636a29a6bee593db2
SSDEEP

1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS8Dc:MOemdTd1o74qlmbbJ+x+Ikpc

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe

Executes dropped EXE 1 IoCs

pid	Process
2628	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2628	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84
PID 5100 wrote to memory of 2628	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84
PID 5100 wrote to memory of 2628	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	84
PID 5100 wrote to memory of 400	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	85
PID 5100 wrote to memory of 400	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	85
PID 5100 wrote to memory of 400	5100	d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe	85

C:\Users\Admin\AppData\Local\Temp\d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe
"C:\Users\Admin\AppData\Local\Temp\d7a5d61abd7dd2566a85b10c0509c6de9380f23fe79589468eea79c8669ea15d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
57KB

MD5
01b96f98e942f27d85f4f7f75c1e9ffd

SHA1
c9b83cd58990043d0b4ddbb02daddda082354b2f

SHA256
2345c3992a2ef1de4c6762b6b7becfeada995d143797e016fbe6ad91760e45ac

SHA512
f44195fc0dea32ac5a89a6ab496610e314a4621e4ce9691fafdf623397ff3561023bcbebc9c07a7c72727decc266236f88d94155346dc2ba9a70c92e5ba14048

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7cdc8777d33db85bc19aefb64879a7f7

SHA1
f2d494d4dfe93a05eb58513935196e8578648adf

SHA256
9af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336

SHA512
34b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
9a13f6100e57f12ce71840df339791df

SHA1
3b8ebd61559ec966199ef918c82be1c32d412305

SHA256
f88f60e7aa07e4662e7d1fcf3f6280f18e38b2ca64bae380662a47b098680a4e

SHA512
71a8945ce0033b401c35bcd124755d156e05b0d5b190e629d970c5dc3850100f5acbc3096f6788c24cc99cc6b498eb0cc4afb7907dc49b2f2b9b6d911331c29d

Download Submit
memory/2628-11-0x00000000002C0000-0x00000000002E6000-memory.dmp

Filesize
152KB

Download
memory/2628-18-0x00000000002C0000-0x00000000002E6000-memory.dmp

Filesize
152KB

Download
memory/2628-20-0x00000000002C0000-0x00000000002E6000-memory.dmp

Filesize
152KB

Download
memory/2628-26-0x00000000002C0000-0x00000000002E6000-memory.dmp

Filesize
152KB

Download
memory/5100-0-0x00000000006A0000-0x00000000006C6000-memory.dmp

Filesize
152KB

Download
memory/5100-15-0x00000000006A0000-0x00000000006C6000-memory.dmp

Filesize
152KB

Download