urelas | 98f298d26f8347863b29c790ce09a464ff7ac1a5d482d6aae440f528188d5404

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe
Size 348KB
Sample240329-athqrsdc82
SHA256 98f298d26f8347863b29c790ce09a464ff7ac1a5d482d6aae440f528188d5404
MD5 13da0292b11a136bec0165fd5a0ade55
SHA1 dcf05a217291797f97b348ffd94704ddfdb7fa10
SHA512 00762c5bb3dd73225999c8104ab9d5ecb4486642aa411a2d69abe62dcca0a6dea1cce2cb9b93c92ac733356676526f2a98ac1d4db5f6dd83da12f0a5cd879e09
SSDEEP 6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZ5:A0G5obGGraOpUWlpI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	begono.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	bydin.exe

Executes dropped EXE 3 IoCs

pid	Process
224	bydin.exe
3148	begono.exe
1588	pelot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe
1588	pelot.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 224	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	94
PID 2668 wrote to memory of 224	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	94
PID 2668 wrote to memory of 224	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	94
PID 2668 wrote to memory of 4868	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	95
PID 2668 wrote to memory of 4868	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	95
PID 2668 wrote to memory of 4868	2668	13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe	95
PID 224 wrote to memory of 3148	224	bydin.exe	97
PID 224 wrote to memory of 3148	224	bydin.exe	97
PID 224 wrote to memory of 3148	224	bydin.exe	97
PID 3148 wrote to memory of 1588	3148	begono.exe	113
PID 3148 wrote to memory of 1588	3148	begono.exe	113
PID 3148 wrote to memory of 1588	3148	begono.exe	113
PID 3148 wrote to memory of 2920	3148	begono.exe	114
PID 3148 wrote to memory of 2920	3148	begono.exe	114
PID 3148 wrote to memory of 2920	3148	begono.exe	114

C:\Users\Admin\AppData\Local\Temp\13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13da0292b11a136bec0165fd5a0ade55_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\bydin.exe
  "C:\Users\Admin\AppData\Local\Temp\bydin.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\begono.exe
    "C:\Users\Admin\AppData\Local\Temp\begono.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\pelot.exe
      "C:\Users\Admin\AppData\Local\Temp\pelot.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2132,i,4018525042804461719,1997165676266557055,262144 --variations-seed-version /prefetch:8
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 74a28b7bb92c11345dc64d66b10875ed3d14501ef2cc72e08deec295f582ec70
MD5 106ae70dff6c19282ce18cbd26da6448
SHA1 9f4993647e3c6f5309d4d9d0dc64abd4d584d702
SHA512 d27b6efb4c8a58bd8c7076d80e4cc4a957d9e1d6b65cd05e394bb941f34f435d7aac2b4736c487e34a60a0cdd3492cd9a716e137b0a7f19c6a51ad277487777c
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 304B
SHA256 b57f5978ff946782d8b3c0389a1d10a2831e9ebb7c3298226e65ae57cbd01452
MD5 39bb71adb764cb47001443e2ba5b90b1
SHA1 4ab236f02457dfef0c838f23b800d55750416fab
SHA512 79053eb1d95e7b3c0eba32c9952f6e5c5c06d8c27cff1fb6afebd2b1dc6c3698a213f5d9b0ab39f48da535952839a141d17967f6acf36f5825e80583225ce040
MD5 SHA1 SHA512

Submit Download

bydin.exe

Path C:\Users\Admin\AppData\Local\Temp\bydin.exe
Size 348KB
SHA256 d911bb81455252f29f257a9bb4e7126f7a88b5f1909c73a5baa85d4473a273c1
MD5 f72d04012e1aa133354afdb8a95d6b7b
SHA1 992169e5ee2ab50c89c3bca217090e891c7802c9
SHA512 c1d32911c8b0f06a29a5d65fd6c79d37162c424691188470172dcda4b69ac5f52321309a85ab7739ccfaf8f49bf2d2783d792b7acaeb837da96c49643076459a
SSDEEP 6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZ5:A0G5obGGraOpUWlpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d12ae887d2840bbc0ce039b7f0e00c9ea88dcb88a222ca3237018a43da6591d5
MD5 81a251cecd80e6d80394a01117cbb787
SHA1 2947894b688a2439d75d12b9a8c32585e6ea10e7
SHA512 75ad1cf8e278fe3c603f4e5912c2ea95ef9321929ae3f323419be90037c2621ee56f0890b5855a3ad5b062afa0097b76f33e46c6512871bd548effeb2a296435
MD5 SHA1 SHA512

Submit Download

pelot.exe

Path C:\Users\Admin\AppData\Local\Temp\pelot.exe
Size 115KB
SHA256 030a385787f8d2bae2ea43114aa0be5af25c5e3c97651d1e884b3459b3ae49cd
MD5 dc82bfa5169d1edbdaa2b404daa5f4d1
SHA1 dca4268aa712d305fee552223634e7915ef1f5b5
SHA512 cdee12f2e193ed3e7669f3ca0bc07dc9691fe565df5f43eee06d48f46eee3f3fc53cd253356e896abfffa3d3a1ea6da375edd5d9f2bf11e19910ba2d6824c22d
SSDEEP 1536:jL9ubrni7nDh0ESGftf9qAv1O5dyq0P1Lp6x8pmHg4Ch4Amg:jpinaWESKtkYkFI65E6Amg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-13-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/224-24-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/1588-44-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-38-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-41-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-43-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-45-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-46-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/1588-47-0x00000000002E0000-0x0000000000362000-memory.dmp

Download

memory/2668-0-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2668-15-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3148-40-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3148-26-0x0000000000400000-0x000000000045C000-memory.dmp

Download