urelas | d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59

Analysis

max time kernel
95s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe
Size

56KB
MD5

61edf4a8acd4536587bc60b13b2afd80
SHA1

316c0a10fdb80bb6234ba32ad85c504a7a54b88b
SHA256

d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59
SHA512

ced359864710ccfd7fce202c59d2a3b6021650453ef61bd6951dbd0416957deecd104bd1da9e6fbbdb22e2dc4c41e6ce834e29815d85ac5ba12c428208f0701e
SSDEEP

768:egjKOwfkQsxi4CUWsFZzdXCHuWFpuQlBVQayBAFp1pAK4gpuK1cnPdFmfbpA9ANt:bKOjssTdFMsAX1pA6G0qm1Y8jgFz4f

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe

Executes dropped EXE 1 IoCs

pid	Process
3692	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3692	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	83
PID 4116 wrote to memory of 3692	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	83
PID 4116 wrote to memory of 3692	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	83
PID 4116 wrote to memory of 3220	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	84
PID 4116 wrote to memory of 3220	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	84
PID 4116 wrote to memory of 3220	4116	d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe	84

C:\Users\Admin\AppData\Local\Temp\d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe
"C:\Users\Admin\AppData\Local\Temp\d6cda4a344b3b05b54926ca4d734cbd79a90770ee2257ef01cc89b5ce3e2dd59N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
56KB

MD5
c80b94ee7fb039a5db3fb6e6a206c392

SHA1
26b6798e435c9bd22824b3057455b4c22025695c

SHA256
bf4d981759461e10d345913160e0c976128b8d608676e9b462b1fcd1563e586d

SHA512
58afe8a77b266632a6517f05b85871d61c60e9341c5422e5201ae1f070a5723df2fe40ba79b564ab3ea21faad013e245675f8008d49ac302edf859028fc39fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
94134e617065036a9284037cf825ee54

SHA1
8c91befc063c7e7d0ea99a34254fe00cf42c85fd

SHA256
c2bf93173e57a82a3bb9715dade1f8c30ef3cb950fc73d48d51bca830d3cfc7a

SHA512
ee7f858441923e4ee034f083665e572a7dcc10720d31dc78b18516ea6f80d95b584174c0a4b6f68b2529705c09b9b48a8fe78cb50b862de6d3174c6732a68725

Download Submit
memory/3692-14-0x0000000000C90000-0x0000000000CC2000-memory.dmp

Filesize
200KB

Download
memory/3692-20-0x0000000000C90000-0x0000000000CC2000-memory.dmp

Filesize
200KB

Download
memory/3692-22-0x0000000000C90000-0x0000000000CC2000-memory.dmp

Filesize
200KB

Download
memory/3692-28-0x0000000000C90000-0x0000000000CC2000-memory.dmp

Filesize
200KB

Download
memory/4116-0-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

Filesize
200KB

Download
memory/4116-17-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

Filesize
200KB

Download