urelas | a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1d

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe
Size

69KB
MD5

caae391ec47a6ae99c4a7fafe6187a70
SHA1

f118986a2b3c37f3c7c9505fd74fdffc1d10e00a
SHA256

a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1d
SHA512

b88d471c241ac2ac0ab97ac1267e87aa1a96501b950b4bdd7429aff70cac808a839c4b4d94b2b6cb403845f3abc28d601c8e86386549cd9ef4a7dd49db1e45a0
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOti:l//AjMp+u2onejH2Peh

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe

Executes dropped EXE 1 IoCs

pid	Process
2916	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2916	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	82
PID 4332 wrote to memory of 2916	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	82
PID 4332 wrote to memory of 2916	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	82
PID 4332 wrote to memory of 4668	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	83
PID 4332 wrote to memory of 4668	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	83
PID 4332 wrote to memory of 4668	4332	a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe	83

C:\Users\Admin\AppData\Local\Temp\a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe
"C:\Users\Admin\AppData\Local\Temp\a8e4e0bb97c958113dbd83995125ab7dfb100c515a06ab0350bddbdcea269c1dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
2d842503e11804173402a9015c7614f5

SHA1
2f5c379f32a8fa7a2c376d730599f897bd8b27f3

SHA256
78df3f15dc592dc974bd30cd51b7e9a9b5e96d7891d39dcfcfecc5c5bd3e42ad

SHA512
f78045fbe38a511db52e1359fed78efdae3f4a04cd9899d110e757b92a32206bed2f5da98af2e80c713f02e791f24e1a79ac5e0d05fd7f310b8cad49dbe0feda

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
a4a727a6292d04bd7a783fefa46dd97e

SHA1
a025a6ad275272fb25efec4bf3481dd34e2591f8

SHA256
da6d5383b592b05dfd6fdd30b72b0b37aba063eab5305f662377c5f9a5a96220

SHA512
4b3b5cc5940f7d83ce1350be3fc291ee30fcb1b07e0d0242bd41118ed583d069bca86ba3584ff524a3528655345b5e5bef249c44c34f3481dbbdafa6561d61a0

Download Submit
memory/2916-13-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/2916-20-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/2916-22-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/2916-28-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/4332-0-0x0000000000B70000-0x0000000000B98000-memory.dmp

Filesize
160KB

Download
memory/4332-17-0x0000000000B70000-0x0000000000B98000-memory.dmp

Filesize
160KB

Download