urelas | ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe
Size

68KB
MD5

9f81bedfaf1b15872f87157874b653c0
SHA1

1f7554185e6e08c0e6d30af160a3c87037ebd249
SHA256

ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08
SHA512

80c06a5e628f683f4b3e86413a876ef34309f5fff4120b0b32af9d850c1c54d6f49c0800f663a956f996cd11c551bf7f88c54af3ebb9de6c0b0f57fac7d0f58d
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOcC:l//AjMp+u2onejH2PeS

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2968	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	83
PID 2972 wrote to memory of 2968	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	83
PID 2972 wrote to memory of 2968	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	83
PID 2972 wrote to memory of 3300	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	84
PID 2972 wrote to memory of 3300	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	84
PID 2972 wrote to memory of 3300	2972	ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe	84

C:\Users\Admin\AppData\Local\Temp\ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe
"C:\Users\Admin\AppData\Local\Temp\ba638340ff255614a846f972a2c200ae8e3783916a78803cce2cb85712eced08.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
24c8a6237bdc10833e0bbc6b16d6535f

SHA1
e88dd18cc12c1dea963d53d86229008e6b921590

SHA256
f4bac91110dab693d115d4fc510f845a69b0515840f56f0c4703b3e94b6c3342

SHA512
0b7dc950ebc70104f15040179d19b6fa0a6d29628c9462d68489623cc808bdc3596194a6e328db5d738f6f8a9dc490f1fda4044be044278d886ea8ab654800ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
93286cf08d3195c76e6b63dcd1162fc6

SHA1
b245d032d55e5d39952e6f9429a340cc675ff439

SHA256
f023034fff2e33495d98241f29eba76c69582998a9acfaf2981bf79dbe6fe53e

SHA512
4503f2f8e41e9e51c51ab653d6b3e57c282c5768982ebf8eb790c293adb4dda2bf3fb2eb9f3a7c0c3ac286e57d8e74bddfc7dfe8f04a643f762f3eb00ddb2d41

Download Submit
memory/2968-13-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2968-21-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2968-23-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2968-29-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2972-0-0x00000000005C0000-0x00000000005E8000-memory.dmp

Filesize
160KB

Download
memory/2972-18-0x00000000005C0000-0x00000000005E8000-memory.dmp

Filesize
160KB

Download