urelas | 14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923f

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe
Size

57KB
MD5

fda030c022b4026907d040cbcbc9dca0
SHA1

017fece2f086c827b7c001cb17b111401d3e1f0e
SHA256

14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923f
SHA512

7c953bd05d16b1a9e5e2a4273afb4f518ed32820271a2c9170018fcf2cb78f4409552c0ebbc7b46e0c8be2010a78a6065399399431de957e2dee1ecedd69b3f3
SSDEEP

1536:amZ+4hcuX5uZ79jmvFQTXnz9yQ/PFBhl1e:amZ+luXwy2f9LDhDe

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe

Executes dropped EXE 1 IoCs

pid	Process
232	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 232	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	83
PID 5004 wrote to memory of 232	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	83
PID 5004 wrote to memory of 232	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	83
PID 5004 wrote to memory of 2840	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	84
PID 5004 wrote to memory of 2840	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	84
PID 5004 wrote to memory of 2840	5004	14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe	84

C:\Users\Admin\AppData\Local\Temp\14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe
"C:\Users\Admin\AppData\Local\Temp\14be04addd6f1706da3f07ced41f175c4fd0889f4d6adb80393b1fd874ef923fN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
57KB

MD5
113f5e7f0394dd72ff9c3072817cfd11

SHA1
f837afb8de48ff47fc969e88cb65b96b0019fc08

SHA256
30a6d457701337885b442b1fa7ee9b8d689a1c9892280168a5d84f48b7592743

SHA512
d48c417ec5f31e3ca7dbfc12be4353efba673512c08f01ff56dd3dae38832667396fd3af0cc50011eb98e4b57ad0c775fd783359cc4ade43506e09f81994cee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
26625b4ca7658f7ba4dc7d982782323c

SHA1
574aa314998c39e683675ccf457b0305341a4aaf

SHA256
c494e0ffeee72023dac244366c08072f677ba328ba805f9e480abc2824e99283

SHA512
5a9af4c6be10240dec0d33b37bc6f6836f1db5d0a2a9dd158d63848a8a97dad68e2d9217aca2b2d1cf122d9534aba0d23b247f6686c4ff934bd7035a927d9b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
9b41ac2513863b51f31210b74fec8586

SHA1
93f58c8e9372bd1b4367c90ed2e78c48f66654d5

SHA256
cb72a7329e4c884c08054ca4ebed9f27d1a167693f1dbbeb045799c299e46ad8

SHA512
3a4f6cf646b4b7e8448cb0d7a62ee2593ba2224c0eb6415b48bcbb1b24d5117f6cf6f0194262c5b9ed4e1e4c85f6bf966721a41870d1187652593c2385210990

Download Submit
memory/232-15-0x0000000000D00000-0x0000000000D32000-memory.dmp

Filesize
200KB

Download
memory/232-21-0x0000000000D00000-0x0000000000D32000-memory.dmp

Filesize
200KB

Download
memory/232-23-0x0000000000D00000-0x0000000000D32000-memory.dmp

Filesize
200KB

Download
memory/232-30-0x0000000000D00000-0x0000000000D32000-memory.dmp

Filesize
200KB

Download
memory/5004-0-0x0000000000950000-0x0000000000982000-memory.dmp

Filesize
200KB

Download
memory/5004-18-0x0000000000950000-0x0000000000982000-memory.dmp

Filesize
200KB

Download