urelas | 74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe
Size

51KB
MD5

de6a83dccbb4637f6998ab3d902bc520
SHA1

3dbbd9e0e3fb9cac1a1f11ed770d7d272a5a0ffd
SHA256

74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5
SHA512

54839947280f83df6340d1ea3b5b14c1fcb40221d6d848426c10e8897e2a32c0ea76801a73c089aed8ac68c9c156a6213682bd5cc9883c0b8eaf8e7d310d5838
SSDEEP

1536:lVeVFl6sRsDnQi1Mek/pFRMfKaP7cFwQkXuJXqmrM:v23sD1vSP6cOYXqm4

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1232	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	83
PID 5096 wrote to memory of 1232	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	83
PID 5096 wrote to memory of 1232	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	83
PID 5096 wrote to memory of 1612	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	84
PID 5096 wrote to memory of 1612	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	84
PID 5096 wrote to memory of 1612	5096	74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe	84

C:\Users\Admin\AppData\Local\Temp\74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe
"C:\Users\Admin\AppData\Local\Temp\74aa019566ec3267791f75f24f4da3c3cc6b9814b37da8dea287639dcc5c51a5N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
51KB

MD5
5593cef2155242f9e3465f0dc46485a9

SHA1
63f245b7ebd415289c1a7d952615acef61d0302a

SHA256
eacc3016bb5c7c4bf440dc9e1240fd1d9ae6274c375e4ec8cb255bd26be843d8

SHA512
7e8adb82b4ad99ebd610de86c4bad82dfac0572cb03834013be77a29e967da74b69e26668ef0d2e25d26c93c2c8e0c90adf703a200ceb81f02124182136faadb

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7c1d9e0f564b1e893792dcef5f902a27

SHA1
f8ff96c98d41f1ce0a31d78f56796284c5e47e3d

SHA256
c0b7315aed511cab0685b0bbbcfa2cb7f3e9c36e58f6d7f1576fad807800add7

SHA512
ef6a5eccec808909c7317359908b6cb46e8e074aff903114988b00a237180606257545bd36e5cea9521b13ba19923cd768a3d701f7fdf391a4bd41cdec606fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
5b83a538cbb9a399fc4feee00139097c

SHA1
f52f8ecd0377966c61200cb457d3b60a69430352

SHA256
6dcbb984100ba97e00740ee28579060ea36582418cf17fd86bddd8d56d47527d

SHA512
b7a0792900f7c62ccc8a60892ddf685b858c870b904fb0e7ad0279b4577c6617bf5a4f7172f22d138289171c940b27492aac20e4df2eb3db74041c0a9a67c471

Download Submit
memory/1232-17-0x0000000000BF0000-0x0000000000BF2000-memory.dmp

Filesize
8KB

Download
memory/1232-16-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/1232-22-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/1232-24-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/1232-30-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/5096-0-0x00000000001F0000-0x0000000000218000-memory.dmp

Filesize
160KB

Download
memory/5096-1-0x0000000000150000-0x0000000000152000-memory.dmp

Filesize
8KB

Download
memory/5096-19-0x00000000001F0000-0x0000000000218000-memory.dmp

Filesize
160KB

Download