urelas | c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02f

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe
Size

69KB
MD5

6abd23458b2facfeae286f2917ad0050
SHA1

297e973974ff3bca0100f428e9ed9d00736f05d7
SHA256

c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02f
SHA512

96630c05ff83bf901393221c6ab299d5fe49989bec05ac22a97340082b6c7327545b57f3a5f10b0306b89a395a863ea81783814476a6b5bd164667ec44d869fd
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOrW:l//AjMp+u2onejH2PeEW

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe

Executes dropped EXE 1 IoCs

pid	Process
3176	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3176	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	83
PID 4712 wrote to memory of 3176	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	83
PID 4712 wrote to memory of 3176	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	83
PID 4712 wrote to memory of 264	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	84
PID 4712 wrote to memory of 264	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	84
PID 4712 wrote to memory of 264	4712	c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe	84

C:\Users\Admin\AppData\Local\Temp\c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe
"C:\Users\Admin\AppData\Local\Temp\c9ada9752a8951c74e6a06115df790c40c89bb881410e34a83bf358319d7a02fN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
b250ab4ae00d00d5875e5c6af2814de4

SHA1
a8e2d03a7aa026c1c96ecc2dccd4d8bb8c9b1f13

SHA256
e16f59d78973ddc3bcb760b2f9865eaee9b4fc872de01a1729c195684c8e509f

SHA512
f8f0d73fe80c609b0f463d94ada800c3bf695b1b264669f0494a603cbaa54b9d4b2f9a66fe034a16eb902048e1052d043fe6a54c812da96f4087e784938eecb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
24845d64296defc6648026cd5ea1c504

SHA1
a76f8762f0be4f244aabd7f2e642375dcd10c496

SHA256
42921a0d222b51c43addcd2301facfacb6f8bad533dc27f31aa86e508dac9627

SHA512
7f74cfadf947967eaa8d6230d6952d82149b8f38de3acb3b12b4fe06fc6fed33995d12ea513381b6c1af5ee63915795365fe8529818d2bc0abbfd4e4f72ebf3e

Download Submit
memory/3176-13-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/3176-21-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/3176-23-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/3176-30-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download
memory/4712-0-0x0000000000CB0000-0x0000000000CD8000-memory.dmp

Filesize
160KB

Download
memory/4712-18-0x0000000000CB0000-0x0000000000CD8000-memory.dmp

Filesize
160KB

Download