urelas | 877fe5837cf0d0c2637ef6728da31841094501dc61257722698b38828f895f66

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03531048f4d9369c850888945181cf43_JaffaCakes118.exe
Size 184KB
Sample240328-mkzddaad81
SHA256 877fe5837cf0d0c2637ef6728da31841094501dc61257722698b38828f895f66
MD5 03531048f4d9369c850888945181cf43
SHA1 1e214deb22fa4dd095d9351d91ac5563aad5e7ba
SHA512 f312faed2f987a9da2ee145f078645825f2785ce483ded263fa3b3d6a884a5e67cad3ffde8dff4a82c67b010262926365d8f947c74dec04a26ee2703f2ecdbea
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgw:Thuk8QsH47nW5ppkoI4KEAUgw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	03531048f4d9369c850888945181cf43_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2420	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	90
PID 1556 wrote to memory of 2420	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	90
PID 1556 wrote to memory of 2420	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	90
PID 1556 wrote to memory of 4636	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	91
PID 1556 wrote to memory of 4636	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	91
PID 1556 wrote to memory of 4636	1556	03531048f4d9369c850888945181cf43_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\03531048f4d9369c850888945181cf43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03531048f4d9369c850888945181cf43_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
MD5 ede6388dfbb03ff576508b085d03e793
SHA1 71d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA512 097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 184KB
SHA256 1bd8e97f1a331e685ee327d64a860d5ea2218405932b357531d017a425633349
MD5 39c3f89406c92993abf0da572ab8eda8
SHA1 7e4c45bbc68920f86f5bee0680dba673b804350c
SHA512 af3c6c6992d3fcb0e2f70e9d203081d8c5b04f853b98cb7280299aa482d96be60cc3872a7885da981a111fd932d368d03c1775efb8dc9e3e94a7def5837dd38d
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgw:Thuk8QsH47nW5ppkoI4KEAUgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 9d2325126d0d8e1c856b96e05b93f06e9b19e9ca79647bc90fb2c840380a4be7
MD5 b2f63a651eb31c64ca239717542685d2
SHA1 8371fcb3c498ee31806e583e3d5676e0001349ef
SHA512 d5d2868c858764f0ed28bec267549b36fe71b5306ca177f3e997541d5eff2059967a400d683f314a621e5deeb05c0f72b640d120af1b3bfc34da562ca3e0fe89
MD5 SHA1 SHA512

Submit Download

memory/1556-0-0x00000000001F0000-0x0000000000221000-memory.dmp

Download

memory/1556-17-0x00000000001F0000-0x0000000000221000-memory.dmp

Download

memory/2420-13-0x0000000000E80000-0x0000000000EB1000-memory.dmp

Download

memory/2420-20-0x0000000000E80000-0x0000000000EB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads