urelas | 8cf8ad459022859f3507cfcc3820e80ab7b32be5b8e04c7fd02a646249fe9017

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe
Size 60KB
Sample240328-vgll4sbb5x
SHA256 8cf8ad459022859f3507cfcc3820e80ab7b32be5b8e04c7fd02a646249fe9017
MD5 0b1593220a705fbe99508e183f76033f
SHA1 7e0d56b15ed51225d456b6eb6cb0610f56d44eab
SHA512 faefd3c0de81c3f7bc1dda0715bc74c6d380a6ba12aefca3892a4c129ec32fcc6d06b1dab9324c7eb95d23123f41553ecbd210ecd6816787ce51c436befe6bcc
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPh:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdJ2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2672	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2076	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2076	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2076	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2076	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2672	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2672	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2672	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2672	2400	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 9bf4a80cbe5c3051cf33c69bad4dc548cb81e3236a751d81059eee8c17e857c9
MD5 c7cb66dbf8d54bbe67f62fd19f7577f4
SHA1 73d70f9a2bb7b3f10380d624a66178dfb21b8877
SHA512 7a95f8635d8161ccc4b83793267b83452a3a2c154db37b11de819f04ba89802010b303c018053ab7d9c942a4e7db9aabba9f94c66668fc3a6d8e9048e77d005b
MD5 SHA1 SHA512

Submit Download

biudfw.exe

Path \Users\Admin\AppData\Local\Temp\biudfw.exe
Size 60KB
SHA256 4e1ea7339676d4e52de80d877963bde2030f3361ae22ef809d2e0b6f06baf23f
MD5 8916db530ba5732898f7df747af6330e
SHA1 0fdc9f0f30a931b0167fd9a8142028cace64f00b
SHA512 b8c69156f2ec2b7e45fd64b8c39432a847b6618c080b2c68064f7f1539ab5aab84b5af6e91c509a66ca56bae23582a94c99776bb6d6ad719ee84ca9c2f488468
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPx:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2076-20-0x00000000003E0000-0x0000000000415000-memory.dmp

Download

memory/2076-22-0x00000000003E0000-0x0000000000415000-memory.dmp

Download

memory/2076-28-0x00000000003E0000-0x0000000000415000-memory.dmp

Download

memory/2400-0-0x0000000000820000-0x0000000000855000-memory.dmp

Download

memory/2400-6-0x00000000007E0000-0x0000000000815000-memory.dmp

Download

memory/2400-17-0x0000000000820000-0x0000000000855000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads