urelas | 8cf8ad459022859f3507cfcc3820e80ab7b32be5b8e04c7fd02a646249fe9017

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe
Size 60KB
Sample240328-vgll4sbb5x
SHA256 8cf8ad459022859f3507cfcc3820e80ab7b32be5b8e04c7fd02a646249fe9017
MD5 0b1593220a705fbe99508e183f76033f
SHA1 7e0d56b15ed51225d456b6eb6cb0610f56d44eab
SHA512 faefd3c0de81c3f7bc1dda0715bc74c6d380a6ba12aefca3892a4c129ec32fcc6d06b1dab9324c7eb95d23123f41553ecbd210ecd6816787ce51c436befe6bcc
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPh:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdJ2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2832	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2832	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	91
PID 1456 wrote to memory of 2832	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	91
PID 1456 wrote to memory of 2832	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	91
PID 1456 wrote to memory of 3652	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	92
PID 1456 wrote to memory of 3652	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	92
PID 1456 wrote to memory of 3652	1456	0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b1593220a705fbe99508e183f76033f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 60KB
SHA256 482fb5846fa90625049f06636e84d86b4fdbbae99a7a4c94aef2e7eafa0d9c77
MD5 d6e0167dfd6161fa3153c309a60439d8
SHA1 89585e46e2e217a37830a522022cbcc9fc288a64
SHA512 b2a73995a28d898546f0d7f9d330453e127e1edff4ea7dde943c01801fec596efca7d07f173d1ce6c0344d88bbcdc1bcf114cf1a8e947e2ea630c15fc7ce5feb
SSDEEP 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPC:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
MD5 55e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1 449221fd8d7196a54de2bd583625d8d1b64db56a
SHA512 4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 9bf4a80cbe5c3051cf33c69bad4dc548cb81e3236a751d81059eee8c17e857c9
MD5 c7cb66dbf8d54bbe67f62fd19f7577f4
SHA1 73d70f9a2bb7b3f10380d624a66178dfb21b8877
SHA512 7a95f8635d8161ccc4b83793267b83452a3a2c154db37b11de819f04ba89802010b303c018053ab7d9c942a4e7db9aabba9f94c66668fc3a6d8e9048e77d005b
MD5 SHA1 SHA512

Submit Download

memory/1456-0-0x0000000000450000-0x0000000000485000-memory.dmp

Download

memory/1456-14-0x0000000000450000-0x0000000000485000-memory.dmp

Download

memory/2832-9-0x0000000000CC0000-0x0000000000CF5000-memory.dmp

Download

memory/2832-17-0x0000000000CC0000-0x0000000000CF5000-memory.dmp

Download

memory/2832-19-0x0000000000CC0000-0x0000000000CF5000-memory.dmp

Download

memory/2832-25-0x0000000000CC0000-0x0000000000CF5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads