urelas | 3568215d402da690f4d347f9f78f7a8ab07e272e2ef866b9563ddfce616e8673

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe
Size 184KB
Sample240328-vrydnabe2v
SHA256 3568215d402da690f4d347f9f78f7a8ab07e272e2ef866b9563ddfce616e8673
MD5 0b6ada72acbdde7ab232113869471d23
SHA1 570ced7605f4a3be27e6ef9613ab89b0b35f41bc
SHA512 28eff451db74f86773375634c01f9ab7688453dcf282a29cbc657f6904488f1ba12c8f01a8c5b5fb20535921e7a4081610823495388d04779d4f8b2d1c79920f
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgx:Thuk8QsH47nW5ppkoI4KEAUgx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3244	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3244	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	89
PID 3012 wrote to memory of 3244	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	89
PID 3012 wrote to memory of 3244	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	89
PID 3012 wrote to memory of 440	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	90
PID 3012 wrote to memory of 440	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	90
PID 3012 wrote to memory of 440	3012	0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b6ada72acbdde7ab232113869471d23_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
MD5 ede6388dfbb03ff576508b085d03e793
SHA1 71d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA512 097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 184KB
SHA256 5ca38d7bfc768285f99d8e1b6a31b39a1b48e97f4d174f3fe02890b7659c16f8
MD5 b4a59302a50d5018a6bf73311f0c584e
SHA1 8560dfb2acc891afce7b816a214f730be9752230
SHA512 0894d1ac1af20a50acef86e80b2c27c2ab18bf05e8167b744b21c38e146c0bc16441d5e292fbf52be860e3d9e0a778c56391c045b1cec5e23361f4315606af24
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgM:Thuk8QsH47nW5ppkoI4KEAUgM
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 5683a279c5270ae7cce1526b8c9e9e983e3ec8dfc14185d5d18b43d8dd73e1a2
MD5 1f94503db6c1b2977edaac4b58a1052a
SHA1 7c22638ef26d6711667653bb0a868fc666b37d49
SHA512 df8bcf985aee49f9abfe18ab8ef8bd34071b6fe60b21788e2ae7f2c96ac292ac2c07afe701e57ca6fa23a5ed1431b14361e24e75152cfc05bac3daa8e00d8e70
MD5 SHA1 SHA512

Submit Download

memory/3012-0-0x00000000004D0000-0x0000000000501000-memory.dmp

Download

memory/3012-17-0x00000000004D0000-0x0000000000501000-memory.dmp

Download

memory/3244-16-0x0000000000840000-0x0000000000871000-memory.dmp

Download

memory/3244-20-0x0000000000840000-0x0000000000871000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads