urelas | f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe
Size

55KB
MD5

5f50787c8bc59414d049988b34a328c6
SHA1

af17cfbd8a4ac2f83a11f66b85b91d8690b536f6
SHA256

f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903
SHA512

2ad0008a7ce4525aac9c30ef37b971dd5620bee4915fd14cfac71375c427d488a6ed054cf1f2c50b190e187316f69c00a734b37029db83a30e819d267e19c8ec
SSDEEP

768:egjKOwfkQsxi4CUWsFZzdXCHuWFpuQlBVQayBAFp1pAK4gpuK1cnPdFmfbpA9ANY:bKOjssTdFMsAX1pA6G0qm1Y8jgFzx

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe

Executes dropped EXE 1 IoCs

pid	Process
4476	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 4476	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	85
PID 1796 wrote to memory of 4476	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	85
PID 1796 wrote to memory of 4476	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	85
PID 1796 wrote to memory of 4816	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	86
PID 1796 wrote to memory of 4816	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	86
PID 1796 wrote to memory of 4816	1796	f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe	86

C:\Users\Admin\AppData\Local\Temp\f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe
"C:\Users\Admin\AppData\Local\Temp\f3482ab9b6e8995b293b257daeab8ed9ba166bf50d19138027914aba5793b903.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
55KB

MD5
a022352804c2f90bc03c177e8263d00d

SHA1
76032a9dcf4b628abc99d9af8ae152ba5bd9c465

SHA256
e15b7721239998ea6b07c19869203d42119f9b2615bb1c1c35c2f3d6e907d3e9

SHA512
77fe97f01eaa93f44fc46c72b6a663e4c850591d86819d1774845550f833e6d2a7a1f21d474ec529ea93050c089c860369d0da895411b81a8fe7565bb55509e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
cdcf8e55d6bf9b4b7e7348fe68a8b1c2

SHA1
25f7646210c7657dfd0c3900a90a0847c66a6c18

SHA256
16d4b6958985e455abb0747cb443c7311c4346c21aac5a5ddfe5292c765bbfe8

SHA512
fd362fc8dd3ce685ffb5620df1672a11c1780709373a06707555988b12241fcde895c6342233668177eca85f6092d1f522a5718306673e7938321840aaeb7e2e

Download Submit
memory/1796-0-0x00000000000A0000-0x00000000000D2000-memory.dmp

Filesize
200KB

Download
memory/1796-17-0x00000000000A0000-0x00000000000D2000-memory.dmp

Filesize
200KB

Download
memory/4476-15-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download
memory/4476-20-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download
memory/4476-22-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download
memory/4476-29-0x0000000000DF0000-0x0000000000E22000-memory.dmp

Filesize
200KB

Download