urelas | 9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c

Analysis

max time kernel
100s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe
Size

59KB
MD5

4ae31044ec0012a79e3beef6ae9daf73
SHA1

a8843f037f71c2e52d339a36e683c579b91daf65
SHA256

9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c
SHA512

3bde9a175711022a2e7fc836f7a19bc165092f6614659bb72a960a044aa36e40bb0a2545360673c223951ff063953441b15bad2daeb450272ab565ee87b6c054
SSDEEP

768:jb4zb59Yix/RoyH+5flZirYqc97vFvrpaZG3DHvTdA9GgnOuS5Z3WXcKIZx5uDn:jbQx5oPsr2vFxDPhAvzgdWLIZ7yn

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4900	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	86
PID 5048 wrote to memory of 4900	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	86
PID 5048 wrote to memory of 4900	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	86
PID 5048 wrote to memory of 3872	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	87
PID 5048 wrote to memory of 3872	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	87
PID 5048 wrote to memory of 3872	5048	9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe	87

C:\Users\Admin\AppData\Local\Temp\9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe
"C:\Users\Admin\AppData\Local\Temp\9ac0c3b480a8ff5e9818883f120c6d881dd1ad074258edb253195873da84624c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
59KB

MD5
fa670895263457023fb9277e6de7225d

SHA1
7ee4e0962acee4f92acc683395469613145fde78

SHA256
b33426dbf92d3e23bae33bbd1a10dd5dd0ff8dcc96214d9d951b0db1c0b93b5b

SHA512
2d9984ec186e4750f12f9b52e890da23f13fbec9ee389a02a0bee029afc8361ca55320549940e5305036ee0d2bd6b047fa4fd151aac91a3117128265a0b6c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f02bf69ff6351970bce3b50742a769ed

SHA1
577db2279b6489628583d770f441f3316ff2a560

SHA256
df6e69fc42308fb3e8b6ec778c1ba6afa4ec11d0414c86299df8b573a51f13c0

SHA512
42a7fc0af80713ece991b51ce908444414162de5cb704d1e538794db7fca217fe3d9bfde19d7661f62ccd1d8ec3de362675094f364daf48624ace9e9e2239979

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
7bb650ea8d63e7daa55d8e9345ab9340

SHA1
0265e0bfaec469ec88a600af09f7ec4dbe087611

SHA256
c7905b5e6b514559263bd4dc340a2b92c312f25d0c44ad58f022fbca310dee5c

SHA512
38ebf79243cdecd103a7d9c7d23bc51d2fa2a8ca26d12f005dd8dc8afcb2eb717709c3c7694b3a2d9ed52464773e8ed6a9f98c7a8f7538b9fd3a35f145084bbc

Download Submit
memory/4900-10-0x0000000000EE0000-0x0000000000F05000-memory.dmp

Filesize
148KB

Download
memory/4900-18-0x0000000000EE0000-0x0000000000F05000-memory.dmp

Filesize
148KB

Download
memory/4900-20-0x0000000000EE0000-0x0000000000F05000-memory.dmp

Filesize
148KB

Download
memory/4900-27-0x0000000000EE0000-0x0000000000F05000-memory.dmp

Filesize
148KB

Download
memory/5048-0-0x00000000008E0000-0x0000000000905000-memory.dmp

Filesize
148KB

Download
memory/5048-15-0x00000000008E0000-0x0000000000905000-memory.dmp

Filesize
148KB

Download