urelas | 88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe
Size

68KB
MD5

8b5e9d3f1d95501f2dc371e77765f297
SHA1

3677bd1125433a3427bb4a4e83fb32aaf98fa445
SHA256

88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94
SHA512

83a5fe4382c4d6224a5e8ebc8c7005fb3a6f0f889d56f8c51801ef308155b752c49a29323ddf7d2ed8b45a7413876c2a2b9509ec9797c4dfe735a6c9ec2e9fbb
SSDEEP

1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCare:yLAYUzmdD0sMQl7d7IuhCaq

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe

Executes dropped EXE 1 IoCs

pid	Process
4540	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4540	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	84
PID 740 wrote to memory of 4540	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	84
PID 740 wrote to memory of 4540	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	84
PID 740 wrote to memory of 4340	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	85
PID 740 wrote to memory of 4340	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	85
PID 740 wrote to memory of 4340	740	88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe	85

C:\Users\Admin\AppData\Local\Temp\88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe
"C:\Users\Admin\AppData\Local\Temp\88fa590df4030e28590a4b542faeac7165d0c54a6f7fc7d0bd62341c5c60ec94.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
68KB

MD5
930800d9e44ccc4284d194b43fe3fca3

SHA1
dc7b0e544e16693ce52920f9c5bd927be1ffdb24

SHA256
1ef06dabaee6619da1f640f347669e63b77bb417b1a613ce097e3b6d476756a1

SHA512
bef60a7624219f1e18ba63f55e22bda7495bd3208526ef0b6db87b3e0b328efb24a67a3c0a91d78f6ff61c1c8392045976b8d2a47d66e18dfdd45ec5d3606761

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1c9b2720af0ca9528b47898d9c7f4799

SHA1
80495f16e333f54ecc700252323c2a7cb7d751e1

SHA256
d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5

SHA512
5afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
85b2375984acd1338dad772b272b49c2

SHA1
169e4c1777243e739d5779ea8bd64dd2a653b31b

SHA256
39f43348e2220968461b309f3d5dfbea02c24ab780e18c507bfe896a6dff8ab0

SHA512
866330c86dc935af9b1a7140fa3388ab476dd93ab8244a42ad36d8b4ca4918bb754db43f72c0fe9b509eef323c614edb04334b5c759244dd538209f320b79e63

Download Submit
memory/740-0-0x0000000000260000-0x0000000000287000-memory.dmp

Filesize
156KB

Download
memory/740-18-0x0000000000260000-0x0000000000287000-memory.dmp

Filesize
156KB

Download
memory/4540-13-0x0000000000E60000-0x0000000000E87000-memory.dmp

Filesize
156KB

Download
memory/4540-21-0x0000000000E60000-0x0000000000E87000-memory.dmp

Filesize
156KB

Download
memory/4540-23-0x0000000000E60000-0x0000000000E87000-memory.dmp

Filesize
156KB

Download
memory/4540-29-0x0000000000E60000-0x0000000000E87000-memory.dmp

Filesize
156KB

Download