urelas | 4220a6ffc391eff72c7e13f1586d9c7ce296983b97f1d7c27b79285b85325fbf

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe
Size 60KB
Sample250108-e5q9hawpgp
SHA256 4220a6ffc391eff72c7e13f1586d9c7ce296983b97f1d7c27b79285b85325fbf
MD5 8b6262cdee4386459f010016798f0ce4
SHA1 11bf4c3cba32b41eee5b503dacbb3444c7d46bac
SHA512 7d2ca47e8db852cf8de54c7df9eb8bf2558c145f013be85da2bca15f96bff56ba693453dd40a08170ce7ee325d800a53e1f19407813cc20f0d6dfc13b0aa4f05
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPY:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd5v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe

Executes dropped EXE 1 IoCs

pid	Process
3860	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3860	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	82
PID 388 wrote to memory of 3860	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	82
PID 388 wrote to memory of 3860	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	82
PID 388 wrote to memory of 224	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	83
PID 388 wrote to memory of 224	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	83
PID 388 wrote to memory of 224	388	JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8b6262cdee4386459f010016798f0ce4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 60KB
SHA256 b2c5c7589ceae3415b652a02de86503f50e3aa8f232ef18942340a15a7fe7e60
MD5 c3de723065ab96c2cdd59c176b083b97
SHA1 2e715f1f66de6521f09a98c099c904de0c0ee114
SHA512 713d611fa416474e0171aa1c60072539482d66bb52872c0895e363d8e599a66b656bb53787a83575131c2a544b61c7b02c41c60aa8d5e5b87cee98626ef5255a
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP0:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 44119305829cc542cbddc3fa97a5786a3fb692b2d51dd5efb70bbf92e54398b4
MD5 b1b11ea32aabb939f4444311608e3e14
SHA1 640fe54610c2c5298387cefee61ac95e9cc98555
SHA512 56983cd745128b00b63ed205389d2cf0bd944a83c3029779159ebac3f0dbae91f335cef634728e544bd1dbc75ee321a58655091c618a2315fa4ae9b96eaf09aa
MD5 SHA1 SHA512

Submit Download

memory/388-0-0x00000000009C0000-0x00000000009F5000-memory.dmp

Download

memory/388-15-0x00000000009C0000-0x00000000009F5000-memory.dmp

Download

memory/3860-12-0x00000000001E0000-0x0000000000215000-memory.dmp

Download

memory/3860-18-0x00000000001E0000-0x0000000000215000-memory.dmp

Download

memory/3860-20-0x00000000001E0000-0x0000000000215000-memory.dmp

Download

memory/3860-27-0x00000000001E0000-0x0000000000215000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads