urelas | 5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe
Size

69KB
MD5

64dc3774ba828df8f54fff270cfb1f26
SHA1

33a3bfab1e03c1d11d0842105ea176df96b4d1de
SHA256

5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188
SHA512

b8ed25d6b58caa95acf9f2e7c64f5420f758b6fdeb88a25f14bd6e891688c4b336c1078aa5b80469ec7bdc61b26e341c679a60c650f89de5c6e3b51d6b70b4a2
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOtG:l//AjMp+u2onejH2PeL

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe

Executes dropped EXE 1 IoCs

pid	Process
784	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 784	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	83
PID 2320 wrote to memory of 784	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	83
PID 2320 wrote to memory of 784	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	83
PID 2320 wrote to memory of 3632	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	84
PID 2320 wrote to memory of 3632	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	84
PID 2320 wrote to memory of 3632	2320	5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe	84

C:\Users\Admin\AppData\Local\Temp\5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe
"C:\Users\Admin\AppData\Local\Temp\5d955dfde505098ff8f2a0c997ac247abe2019c4a3fb6f153abe987e66cc2188.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
80f1cc23ffad0c387be81fd89ad1027d

SHA1
97adcf496d2be05425a83a905654491d8168921f

SHA256
83f3fd530b01351232137a7b494550d85545c02f409becd4ac54ed535944749e

SHA512
b7c8c08f7fc80c42a806f2e2a8de150cdc2108c44158f87914a6d7828e7959290653c8c1c68567b9a56949cdc6045916660b0a7104fcebaf559b9d316f8baeb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
dbbcb2f47772ecda9a34d7eeda7f90ef

SHA1
84f99992a4ab633aacef0d1268399d87cc18dc4a

SHA256
1ba20d3704656b3eb8a3e5c1dd71b3a064836eec373a3b2f5d2b6c85e0507a36

SHA512
6a8b7b26b483d1709409a0b1bc696ebeb76bbaecac3fc18c33db73845d41df1bb9eb9ed8dae3d8d7b5716bf2d77ceb275b3d365d0b4f3b98000aa41bc4ec0d89

Download Submit
memory/784-13-0x0000000000CE0000-0x0000000000D08000-memory.dmp

Filesize
160KB

Download
memory/784-21-0x0000000000CE0000-0x0000000000D08000-memory.dmp

Filesize
160KB

Download
memory/784-23-0x0000000000CE0000-0x0000000000D08000-memory.dmp

Filesize
160KB

Download
memory/784-30-0x0000000000CE0000-0x0000000000D08000-memory.dmp

Filesize
160KB

Download
memory/2320-0-0x00000000003E0000-0x0000000000408000-memory.dmp

Filesize
160KB

Download
memory/2320-18-0x00000000003E0000-0x0000000000408000-memory.dmp

Filesize
160KB

Download