urelas | 19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe
Size

68KB
MD5

4b843db0be5fe85a50d692fc422facd2
SHA1

8433f8a5dbf7a7098941e22428474418b96907c4
SHA256

19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c
SHA512

abccc913e6f05332febd6937ba89da0ee9805ea68f3539ef188f28d052a25c9abb9f0f0bc1c0db53957def83a762b5de5720d7baaef6135648f5c3267bb21ef9
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarV:yLAYUzmdD0sMQl7d7IuhCaB

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe

Executes dropped EXE 1 IoCs

pid	Process
2308	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2308	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	82
PID 5076 wrote to memory of 2308	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	82
PID 5076 wrote to memory of 2308	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	82
PID 5076 wrote to memory of 440	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	83
PID 5076 wrote to memory of 440	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	83
PID 5076 wrote to memory of 440	5076	19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe	83

C:\Users\Admin\AppData\Local\Temp\19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe
"C:\Users\Admin\AppData\Local\Temp\19684c0ade8e1779e1646f2c407c164d0028f4f5a9adbb79bda1234fce67a16c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
8ce0d3370540050b8d319939b3c08393

SHA1
50bde6ff5676a6854854598b5252216d5e931628

SHA256
a4530f5caad74684ef5fcfca118aa8107d877a9e179a6ba9beba839fe069cdff

SHA512
80e87ba8263bfa7c81fdaef0e145a72ba0f20b737efaa710e870cb1dbb22c9a667a7dd782733461a9a83071d7ca404265cdd5e12b8648c4cc85cc086d5720682

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
27769172e46a76801e1f61a525388023

SHA1
29da50dccae7abbc4a69ef9ddd29f973aa27059d

SHA256
0ba6e9e7b454284c8b6a6f70371489823a138d549d5f0428e36635bca19fb4a5

SHA512
ddab8e0b2fbed99784e28b37c71368589c96c0dec5d8063d84788b3a43c40ef0ae2c2babc021e63c1b312e6516ec8a3ea0e99d4802e5da057d94567743b4c313

Download Submit
memory/2308-14-0x0000000000230000-0x0000000000257000-memory.dmp

Filesize
156KB

Download
memory/2308-21-0x0000000000230000-0x0000000000257000-memory.dmp

Filesize
156KB

Download
memory/2308-23-0x0000000000230000-0x0000000000257000-memory.dmp

Filesize
156KB

Download
memory/2308-29-0x0000000000230000-0x0000000000257000-memory.dmp

Filesize
156KB

Download
memory/5076-0-0x0000000000FE0000-0x0000000001007000-memory.dmp

Filesize
156KB

Download
memory/5076-18-0x0000000000FE0000-0x0000000001007000-memory.dmp

Filesize
156KB

Download