urelas | afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bceb

Analysis

max time kernel
95s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe
Size

68KB
MD5

be98298b83cc3177ac4bc0076e3cae30
SHA1

bc09cf78b62b62fdb53a777d10a6ae9c8f598398
SHA256

afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bceb
SHA512

330ea13a5853ddf129f3340b9ca853ebdbe5124fa8cc8e7895c011ee4686125a97c768c2ca727a85d32f8ceb827da94c509afbd2d2d5e36dafc5cbef12782cdd
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCara:yLAYUzmdD0sMQl7d7IuhCa+

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe

Executes dropped EXE 1 IoCs

pid	Process
1796	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1796	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	82
PID 2396 wrote to memory of 1796	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	82
PID 2396 wrote to memory of 1796	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	82
PID 2396 wrote to memory of 3104	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	83
PID 2396 wrote to memory of 3104	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	83
PID 2396 wrote to memory of 3104	2396	afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe	83

C:\Users\Admin\AppData\Local\Temp\afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe
"C:\Users\Admin\AppData\Local\Temp\afa607210468acefdc2ca7557a2828a77d88c9f4a3d8ee0c93ea9ee21525bcebN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
dc0448a0b98b0856e2a9110f02a4b900

SHA1
1aed395442c3d11160c89ad6035bc582f51820a6

SHA256
0ca60728c642f91906c695acc883c70d7da9bc44cf0c143684bbbef14e27e805

SHA512
26b73b2752fa9b4a5f53b3dd2395704796d1a12b6f7183451f1caadb5e881b27f5da7a82345ed9657659801e2b04205a9e4341a96fdc0b1546d1ebf08c773254

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
15eb0538d2828b24439dd1d4faea872b

SHA1
4337ddb0d38918d566176c7f8f8799d30fc1fc4a

SHA256
133d315ee7746a07b99cf3ca4fcbbf0334f97949d514323ca5e39db12ac573e2

SHA512
b922551e6d19c9078307a953ffc8be6ffcb1b0305001802ce9e2f964539834d2b9017c1fded32e2efc6e8b9d0d5e8570c35815800b8e7f06321f9ed6059c5600

Download Submit
memory/1796-16-0x00000000007F0000-0x0000000000817000-memory.dmp

Filesize
156KB

Download
memory/1796-21-0x00000000007F0000-0x0000000000817000-memory.dmp

Filesize
156KB

Download
memory/1796-23-0x00000000007F0000-0x0000000000817000-memory.dmp

Filesize
156KB

Download
memory/1796-29-0x00000000007F0000-0x0000000000817000-memory.dmp

Filesize
156KB

Download
memory/2396-0-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Filesize
156KB

Download
memory/2396-18-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Filesize
156KB

Download