urelas | 7d70ade63584563aafe7c2e7c99ee965d134b790e348885e93c8727cd13488dd

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe
Size 1.9MB
Sample260504-macfvsgv3v
SHA256 7d70ade63584563aafe7c2e7c99ee965d134b790e348885e93c8727cd13488dd
MD5 462aa781b23741680f918ea34448cbf8
SHA1 d1f82a12f50fc00ed115d99aff214c3da52cf14a
SHA512 6ac45e53d5bf7f2dc9971a40b0c468bc5a66106fdece955a566c2f69255b91833ff9e91b3db543e93156fd61c30208df646134fe10d9bcb5dc53da694efa15b3
SSDEEP 24576:KANI5NAVDKUTbQIzFLwLIM0iwg99Vpibu9n:KACgVmgbQIzZMPXpB9n
TLSH
T1EF95E457EB814AD9E78D0836DF548150972AF2699BFF1261346802CCDE87387BF61A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4860	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4860	4220	2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe	79
PID 4220 wrote to memory of 5980	4220	2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_462aa781b23741680f918ea34448cbf8_elex_glassworm_icedid_njrat_rhadamanthys.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 1.9MB
SHA256 2550fa5cbdb84eb5c1726bff103998717008f62ae1928e760152ddfb3b87b83c
MD5 d670d6ecb341c29c4461c21be45790ac
SHA1 e8c4e8f7f084fe29040c85bfe6b53fd09b40bfeb
SHA512 f87a0a8cf28043fbe8b0bd0ecc8d509bc73828472c79f25775c0d4d543f36e2db57550c953c9945dc0efdaced682bd598e1f82cb67440b6a7264c7e8f0b2fdb3
SSDEEP 24576:KANI5NAVDKUTbQIzFLwLIM0iwg99Vpibu9z:KACgVmgbQIzZMPXpB9z
TLSH
T19495E457EB814AD9E78D0836DF548150972AF2699BFF1261346802CCDE87387BF61A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3
MD5 1e75a7e32613b9d0b73f13b66c2c2f58
SHA1 035e2d6ab4ac34190f0e684681098188409e978c
SHA512 e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf
TLSH
T1F8F092D10076B0443210E903C625C7A127A30FCE088B4EC56046B231B43865D5204A7C
MD5 SHA1 SHA512 TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 378B
SHA256 1a452e071216a10fd7f959708326051994810216f86495e300b15b25acc92390
MD5 283d9fcce2095c2468c4a66cdb1870fb
SHA1 755c762591013062ff5cbf76ccbabe8e0e5375d8
SHA512 b336df19f53e0c243ba161861ec6cab406a897945cd8c03fc3638262564a1317df8ea70778cafe1d9a2a9c585fd26cdf02777986a6bf04211aef4025fa3213a7
TLSH
T15EE0D82101EBCE9A0C1E905B25A5914D8561AAE83F82178ED733CD6F22DA81FF9D2312
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-0-0x0000000000EC0000-0x00000000010AF000-memory.dmp

Download

memory/4220-1-0x0000000000ED2000-0x0000000000ED3000-memory.dmp

Download

memory/4220-19-0x0000000000EC0000-0x00000000010AF000-memory.dmp

Download

memory/4860-17-0x0000000000B12000-0x0000000000B13000-memory.dmp

Download

memory/4860-16-0x0000000000B00000-0x0000000000CEF000-memory.dmp

Download

memory/4860-22-0x0000000000B00000-0x0000000000CEF000-memory.dmp

Download

memory/4860-23-0x0000000000B00000-0x0000000000CEF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads