urelas | 3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2025 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe
Size

138KB
MD5

6490cbf8f2cbdc24b11a678920398c10
SHA1

b2c744cd46c377932eb1d17c7dd76c9cbc40a207
SHA256

3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2
SHA512

e5857ead1c45f51d67678b22b599e43c03df8728ef2e9907441b964a6faa08961ba25132e8a03cc60a2e568cbb653339bd2dcc2a84903d62f9d0f09db3a5a12d
SSDEEP

1536:7GnrJLwAXDtIBcUyk+8CooNvy3GNbcq7+sWjcdmx64Tc/qmrk:CtpCP+/oGvWSldmx64Tc/qmA

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe

Executes dropped EXE 1 IoCs

pid	Process
4404	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4404	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	86
PID 3724 wrote to memory of 4404	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	86
PID 3724 wrote to memory of 4404	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	86
PID 3724 wrote to memory of 5008	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	87
PID 3724 wrote to memory of 5008	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	87
PID 3724 wrote to memory of 5008	3724	3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe	87

C:\Users\Admin\AppData\Local\Temp\3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe
"C:\Users\Admin\AppData\Local\Temp\3bb9730d1ef76efb2a9d2b60e67b0d55a126bc487a77f339d7503c30f63b0cf2N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
139KB

MD5
d808c1400993265faae6c17afe48b6e9

SHA1
caaf00cfe1454d3b1a48d4fa5a4048ac7f4acde1

SHA256
fd0a716cb5a04aa14cdaca780774fad5cdfd4b5f1d720c7212049b0cc722a0db

SHA512
418be7fdcd12969c4885a91a466c30b0550aa99c489084f45a6485812c8c16fda01da6b33885d74d5bb88528e65c67434a1ba7840d386d8db3afe9babb36bde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7c1d9e0f564b1e893792dcef5f902a27

SHA1
f8ff96c98d41f1ce0a31d78f56796284c5e47e3d

SHA256
c0b7315aed511cab0685b0bbbcfa2cb7f3e9c36e58f6d7f1576fad807800add7

SHA512
ef6a5eccec808909c7317359908b6cb46e8e074aff903114988b00a237180606257545bd36e5cea9521b13ba19923cd768a3d701f7fdf391a4bd41cdec606fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
340B

MD5
20193d6e5f55580e8f3d7586216d246b

SHA1
54b534eaf699a1575ee60f823469c4a99e7d8c9b

SHA256
66745c9b0a8ae46364319dc7a216609792e754f68b561f92917380b0872862d1

SHA512
15df75cfd706dd76f3022bad0b47077793d9b2ed76f078825d86bcdbde6a455b13aa0841e7ffc7d549feff5147b7c282c8df2f53c253e849da90755eee40d3ca

Download Submit
memory/3724-0-0x0000000000910000-0x0000000000938000-memory.dmp

Filesize
160KB

Download
memory/3724-17-0x0000000000910000-0x0000000000938000-memory.dmp

Filesize
160KB

Download
memory/4404-13-0x0000000000B40000-0x0000000000B68000-memory.dmp

Filesize
160KB

Download
memory/4404-20-0x0000000000B40000-0x0000000000B68000-memory.dmp

Filesize
160KB

Download
memory/4404-21-0x0000000000B40000-0x0000000000B68000-memory.dmp

Filesize
160KB

Download