urelas | 62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe
Size

69KB
MD5

50a4b911d2417f81244ca66624403943
SHA1

86406aa5887e2c50fee0735d5035168c76259e45
SHA256

62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc
SHA512

b8a2aa245fce67dfe6c6d96652c4d482d0b5520c4d9d82954d0718f3c2870754d304ab1766ca3528613ccbaf5ed01ce5db427d1ce9029a53588499af20835cbd
SSDEEP

1536:04/WgLAjdZsp+uChoLnDeoqYAJjvLFymnHsPeOtz:l//AjMp+u2onejH2Pe+

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\International\Geo\Nation	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe

Executes dropped EXE 1 IoCs

pid	Process
3828	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3828	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	87
PID 4508 wrote to memory of 3828	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	87
PID 4508 wrote to memory of 3828	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	87
PID 4508 wrote to memory of 3572	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	88
PID 4508 wrote to memory of 3572	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	88
PID 4508 wrote to memory of 3572	4508	62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe	88

C:\Users\Admin\AppData\Local\Temp\62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe
"C:\Users\Admin\AppData\Local\Temp\62d08e249c0fef8fc441be25a766b65169416db8f6e2f2c04294e1f80ce458bc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
69KB

MD5
f92689fe78a564516853352dc4f56927

SHA1
e8c9c0b4f8c6f0efa90aa8f4a595e0cca27618d2

SHA256
f1d2fa8eb4484de29cc4ac9cdbbadd3c48eb90c6e80decb7834c6b1e0ac1c1aa

SHA512
a00af3501b0e70cc3bf545857b71c7cf8292ad5cbe4ad4996e9a589fc300554bb0954b037f9e390db762b139f260247a5b59866713e6a5056ee8ed63b5725576

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a250860c0687ed9dda488805c025a2d2

SHA1
0c181ed3b46463d35631ca169f0928c33a1da389

SHA256
3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

SHA512
0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
8abe1354d4c11e0b66b7f8fcdc2c8123

SHA1
10562815ada13e1df396df7dd4616dd011510e3f

SHA256
76f7352557f7a0977d09838e8bfcbf40acaabd6280b752e0d7e8b9b684cc316f

SHA512
3776595719ab95e6944df46b5f1edeb09f29f6d7c25ffc76ba4a2ac25fe5256ccbe83ae17c276c8a5cf0fe521418c2779eb15e0bf9f77ee9c597e1db797d1efb

Download Submit
memory/3828-15-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/3828-21-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/3828-23-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/3828-29-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/4508-0-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download
memory/4508-18-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download