urelas | 8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe
Size

68KB
MD5

be9048d51fe47d9767dc4dc8d6a09470
SHA1

226c1623ded53b36835d36889329ba78ef101bf0
SHA256

8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6
SHA512

fb2b9c5479c1e915781fb216f2b08443f300b6b83d6e982b897d795a0008b2613585c4ae10c6bca2f95929092ee1cb67f1b734b2e8d3cfaff027eb9aa864bfd1
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarf:yLAYUzmdD0sMQl7d7IuhCaD

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1392	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	85
PID 2372 wrote to memory of 1392	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	85
PID 2372 wrote to memory of 1392	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	85
PID 2372 wrote to memory of 872	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	86
PID 2372 wrote to memory of 872	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	86
PID 2372 wrote to memory of 872	2372	8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe	86

C:\Users\Admin\AppData\Local\Temp\8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe
"C:\Users\Admin\AppData\Local\Temp\8b0b493dc30ddb2c1440820fb582d324c68f62cfba8c9d312f1d9496ca9a53a6N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
8be2e4f8b62e3733903fae94d2a0f6b3

SHA1
31bc8a511aefd30ef512f663ffd139426054a98e

SHA256
ebf47463efdbe72a79abb994a5b34d518a0811b6aef66b6ff130958814338fdd

SHA512
55b13b1bc08a8fae5ded1980ce1a69286ee0635d0fbfadb03fa9c973f40c814546ba7bce9b4f59f8531678e825fb3f072bf140d8799cbf5df0d462f13ef78736

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
c9331fd4c4281435fbc27e639a0c77e1

SHA1
91e645c464f2f62b524d8c8d233e4d7d6cc31796

SHA256
56fa8bcfcbb951b528f0d2d7915d064118ab1b69bc721ce18cad6c8932eeecb7

SHA512
1e6813b8c155392e1f3df98695bf7a42211a35b0d022fbf83672b5b5e704ce800a13497ffbbbc2678c75b72b72c9440f7a495c3728142ec523cd9668b2db8a9e

Download Submit
memory/1392-15-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/1392-21-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/1392-23-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/1392-29-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Filesize
156KB

Download
memory/2372-0-0x0000000000A50000-0x0000000000A77000-memory.dmp

Filesize
156KB

Download
memory/2372-18-0x0000000000A50000-0x0000000000A77000-memory.dmp

Filesize
156KB

Download