urelas | 2f57b93b68b65432c85fb0ef86c4aafd0bfd938433deb72827fd12b910033bb0

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe
Size 192KB
Sample240328-k8d18seh86
SHA256 2f57b93b68b65432c85fb0ef86c4aafd0bfd938433deb72827fd12b910033bb0
MD5 01fcb8c6e4b7738fcaa4aa35626d5e37
SHA1 cf6ea29cd11a922ad637bb213a9b193ef6cea78a
SHA512 98df400f455da819da30ff880097d815f778704c94e0fa869fc425caa8a67ae997bfc87d4dc7f550865ff0ee85b2a8d90a936b5e3a55ab17d70e17c7640f6930
SSDEEP 3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhC:gExhk7rh7NEOIYWlPM6r6C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
868	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 868	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	85
PID 832 wrote to memory of 868	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	85
PID 832 wrote to memory of 868	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	85
PID 832 wrote to memory of 884	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	86
PID 832 wrote to memory of 884	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	86
PID 832 wrote to memory of 884	832	01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01fcb8c6e4b7738fcaa4aa35626d5e37_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 192KB
SHA256 d7cca308cbccf3950b7c1eaae64c5dcfbd208ae0e3918e79304ad3f7591a9443
MD5 f0836dc8597d4c9555715b83ebd873d9
SHA1 27ad4ff04812bf052fd4d9ea4c4581a4b7bf8c20
SHA512 feca6d2dd5c1028b81424be638f4ecc0392b6890f168fa9c082f19fdddee17a1804eac160d7a118c0870d773e25a2bf3007d72e390a18b76e999e81772a17437
SSDEEP 3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhm:gExhk7rh7NEOIYWlPM6r6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f
MD5 2776cde4761cefd1198f4712989957b1
SHA1 c801245a080524e704e8e3da95700e58e9d1ca3c
SHA512 bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 ae7887b643b0d65f8aef6bd73a9fcdd3a7472f45698f4310f366e03deb9c3ab6
MD5 ec238d913b8c4628220670b71a091a82
SHA1 dfbe888e30fce9b45e94f7e624a41bcd7b3a347e
SHA512 d2736c1bbce54887bb2ec1ecdac7d0a6668efbc77af25b94da2a562da224887247118033ca70d0362b6d77d88c1a8150394474fa6be0a858577d0845dd689e71
MD5 SHA1 SHA512

Submit Download

memory/832-0-0x0000000000520000-0x0000000000554000-memory.dmp

Download

memory/832-14-0x0000000000520000-0x0000000000554000-memory.dmp

Download

memory/868-13-0x0000000000790000-0x00000000007C4000-memory.dmp

Download

memory/868-17-0x0000000000790000-0x00000000007C4000-memory.dmp

Download

memory/868-18-0x0000000000790000-0x00000000007C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads