urelas | 92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe
Size

69KB
MD5

b7ee903b61c98d2e242da2622f1c707d
SHA1

800d5176e32f91b2bcf65ef68bd9052763a07de1
SHA256

92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73
SHA512

bb6f7f949dd89cf15bea3c0a426fb049a57d2bdc673275207b00f7ed387214a00c5abb7ba0c43b0c6acedb5031b8878d6b03a24f45e613db7b6468260f9c48b8
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOtVR:l//AjMp+u2onejH2PeGR

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe

Executes dropped EXE 1 IoCs

pid	Process
3492	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3492	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	83
PID 1404 wrote to memory of 3492	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	83
PID 1404 wrote to memory of 3492	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	83
PID 1404 wrote to memory of 3448	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	84
PID 1404 wrote to memory of 3448	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	84
PID 1404 wrote to memory of 3448	1404	92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe	84

C:\Users\Admin\AppData\Local\Temp\92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe
"C:\Users\Admin\AppData\Local\Temp\92da0c4f704a1a4624ff6d9c7af5bedb57f6e456f66046855c265f0455b23f73.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
d8af10cd959a41ec983ce87b7306806a

SHA1
88cfc57cd4945c58467a5eb228a0a60f72fa5d12

SHA256
ffe5465a31f141d90dfd749d245ae0d138a8db398b4e28b9a057610982b85978

SHA512
e6d542918ccdd5ad1047127d13aeeb3eeea3e2695104a1f0085a2c631d0fe1a2455983554c0876884c180971333d0a44d866cece371881b28d90ed3d6e3bd39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
44c4930e388065fe7362f1be97f6f107

SHA1
49625c769ffdbe89f355fd5ec5e89501c1caab1c

SHA256
d031f359bae5e5281e7c16913aa4ef08a0fa3f6e0f1a3e56382033a9b41acbe7

SHA512
c571199a3482548683293f922031d174c79a474a36804a709cf50ba58164df5d5fb565a3d994dbdca6fe8cb52cefe309cfcddd4c5eda25a081e1bbb467bc2dfa

Download Submit
memory/1404-0-0x0000000000F40000-0x0000000000F68000-memory.dmp

Filesize
160KB

Download
memory/1404-18-0x0000000000F40000-0x0000000000F68000-memory.dmp

Filesize
160KB

Download
memory/3492-15-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/3492-21-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/3492-23-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/3492-30-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download