urelas | be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe
Size

68KB
MD5

b21b74cdc8b790d5ba17747cb93a3180
SHA1

e5f3fedaf3a58c67fea2657524073c9c55fd0de5
SHA256

be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4
SHA512

9a5371fb9801e72736ec72cfea28ffafac8a040329439af98c801313de1358ae1c46eaf1208caa541f01a940c3dc15425ff0a5e68e6c691ede4c4d4e91ffb877
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOcy:l//AjMp+u2onejH2PeC

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3020	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	83
PID 1404 wrote to memory of 3020	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	83
PID 1404 wrote to memory of 3020	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	83
PID 1404 wrote to memory of 1068	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	84
PID 1404 wrote to memory of 1068	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	84
PID 1404 wrote to memory of 1068	1404	be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe	84

C:\Users\Admin\AppData\Local\Temp\be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe
"C:\Users\Admin\AppData\Local\Temp\be74e23d94cbbb1f16da67389cdf38a842b51ac8dbc08dfcd8b7e92f6886fac4N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
22f43fc7569fc447bfc51acac75660ed

SHA1
3d4ff5d90ba4ddef6d770096202cac3e8709b154

SHA256
b28a30e637f5e1708c2e5e8ebf29a56c7e952f772c5bbdf53c332fe93c056c1f

SHA512
f6c25a119c1001d550426b7252869aed8500c6075338b1798b3cd05562e62d4d431110e692c0fc3c627fd467be8106972e24963dc3390905312458ec253a8b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
1969d51faa63787eeef760e34462b862

SHA1
e8d985b0bfadc3d62ecd07e9a938354fbd2d2d26

SHA256
3ba93f8fbd1fef70dfe5ff6dc5e54488fec9be6f1154bb7eb921f26aaf289a9a

SHA512
ebebd3b41ab9fcab42bdc0e0aff4cb682f630e6d4b539b7cc8b14e49a78af3860b0ace2e5e702886cd8f2525c2fdbd88f1e61a5e3e29a281fb381c72957faa3d

Download Submit
memory/1404-0-0x00000000005F0000-0x0000000000618000-memory.dmp

Filesize
160KB

Download
memory/1404-18-0x00000000005F0000-0x0000000000618000-memory.dmp

Filesize
160KB

Download
memory/3020-13-0x0000000000360000-0x0000000000388000-memory.dmp

Filesize
160KB

Download
memory/3020-21-0x0000000000360000-0x0000000000388000-memory.dmp

Filesize
160KB

Download
memory/3020-23-0x0000000000360000-0x0000000000388000-memory.dmp

Filesize
160KB

Download
memory/3020-29-0x0000000000360000-0x0000000000388000-memory.dmp

Filesize
160KB

Download