urelas | 748684fef711702dde1c4569bf6eeeb9bda95971a687479de2abe628e83c462f

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe
Size 780KB
Sample240328-vf4rasbb4w
SHA256 748684fef711702dde1c4569bf6eeeb9bda95971a687479de2abe628e83c462f
MD5 0b1178b025587f68088b8ae13631a463
SHA1 b1912b0bea4fcb2c7d28fc79a5aca1ca0d5a2509
SHA512 f9c60e3b8b6c0c5ee9dbcf6484543d5adbf01d10f294c77863f98ee85b562169cb2fabc58b2c6d551b85c56e06ab0fcf0ed5122cfb3afe91a6c9bbe04dd09da1
SSDEEP 12288:YOlx4kk9HKda4YfM/1T3PPSnPI2VAWNDTJHq9DIMTW8c18P:YA4Ya1fQzPPSnPFqWtTJK9DIMTW8JP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2884	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2296	jobot.exe
1020	lujop.exe

Loads dropped DLL 2 IoCs

pid	Process
1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe
2296	jobot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe
1020	lujop.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1020	lujop.exe
Token: SeIncBasePriorityPrivilege	1020	lujop.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2296	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	28
PID 1556 wrote to memory of 2296	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	28
PID 1556 wrote to memory of 2296	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	28
PID 1556 wrote to memory of 2296	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	28
PID 1556 wrote to memory of 2884	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	29
PID 1556 wrote to memory of 2884	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	29
PID 1556 wrote to memory of 2884	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	29
PID 1556 wrote to memory of 2884	1556	0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe	29
PID 2296 wrote to memory of 1020	2296	jobot.exe	33
PID 2296 wrote to memory of 1020	2296	jobot.exe	33
PID 2296 wrote to memory of 1020	2296	jobot.exe	33
PID 2296 wrote to memory of 1020	2296	jobot.exe	33

C:\Users\Admin\AppData\Local\Temp\0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b1178b025587f68088b8ae13631a463_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\jobot.exe
  "C:\Users\Admin\AppData\Local\Temp\jobot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\lujop.exe
    "C:\Users\Admin\AppData\Local\Temp\lujop.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 304B
SHA256 f0dafa5a6e9f266206ad9d928a851dd69de1ce78d7db7018fd185fab7d80380f
MD5 554845311fbf0f7c452f08271dfcc475
SHA1 19a2c2033d9affe2a9a458ca40f0455cc14f91f0
SHA512 fe579d7ec525b9ea16854906093e7853e6fda56eb94f844e8ca4a39ad638c1879ee2d36ae082095f28b9e93daa3a88b05c58ad7bdbfb28f553ec90a13ef47be6
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ef62a78c91df58241c3c6705274f97127ddd64894da9c1e86284b5e131725d0d
MD5 c03edc2322ec423ae03c222a49d375a1
SHA1 480a0292cdb156089f77ac3826fc035d4af42f0e
SHA512 d949c3ce740d8e64b97b6d6ddb9be34e77c3f0dc5881c8054a3b6fdfaafe1aa606dd0691f3b1dcb6ee9d32f22c1b706474dc7527ad371e4f64b048b66bef3def
MD5 SHA1 SHA512

Submit Download

jobot.exe

Path \Users\Admin\AppData\Local\Temp\jobot.exe
Size 780KB
SHA256 548d21eb92add47862bb281e05f28f56b9643634ae213f1d4ff6febdb4218b14
MD5 05229512b31a523ffbde576cb722ce15
SHA1 d2d1332525e585f4be9698fd1e11ea271f49f8af
SHA512 ccaf77cbcfe7b5f9d28c429f5c630c8b9d42f3212b4a6b5b95507ee2da89c7c5b282ad17022665edb4db5f231cb056567fe55f09c3c8476e0d76aae362a60386
SSDEEP 12288:YOlx4kk9HKda4YfM/1T3PPSnPI2VAWNDTJHq9DIMTW8c189:YA4Ya1fQzPPSnPFqWtTJK9DIMTW8J9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lujop.exe

Path \Users\Admin\AppData\Local\Temp\lujop.exe
Size 156KB
SHA256 0b4a5e3bf2eb7fb5f4eb0f5621fb9cb0a340ed78907d7a285facf5ded1fe9084
MD5 bc00ca130d45b9543323d3517055c1ea
SHA1 1443e184c0eac76933c8385f014d18fb54279499
SHA512 f718fb55847bee0c9919dd53e334bfcb007a6a79a579f78057ea8169f970a5fcb9e15c8e3d3bf185bb3f081f30f3a1ce81b4d2771ff848edc226c168ce5125c9
SSDEEP 3072:HOtGXXNoLZBrL2AvIKor5J2MMA+mNHFWfRXlz6X5had8sHfbUU24r85mP3:8CXNo1JL2KC5J2MMA+8rQd8sHze4J3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-30-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-34-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-37-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-36-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-35-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-33-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/1020-31-0x0000000000230000-0x0000000000232000-memory.dmp

Download

memory/1556-0-0x0000000001280000-0x0000000001349000-memory.dmp

Download

memory/1556-18-0x0000000001280000-0x0000000001349000-memory.dmp

Download

memory/1556-8-0x0000000002890000-0x0000000002959000-memory.dmp

Download

memory/2296-27-0x00000000033B0000-0x000000000343F000-memory.dmp

Download

memory/2296-29-0x0000000000B50000-0x0000000000C19000-memory.dmp

Download

memory/2296-21-0x0000000000B50000-0x0000000000C19000-memory.dmp

Download

memory/2296-17-0x0000000000B50000-0x0000000000C19000-memory.dmp

Download