urelas | 5ca0de984b5a82bd2ca1b7258c0a4ece7c21940b561b77508fe22ea6452e41d0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe
Size

60KB
MD5

26c8a6ff09b17b16b6579bbfe354f608
SHA1

371799f2f01983e73ee1f6aad129e982c11bf0d6
SHA256

5ca0de984b5a82bd2ca1b7258c0a4ece7c21940b561b77508fe22ea6452e41d0
SHA512

92fd43257414d6c59c7dbe6376844d3b7b99c0a5e0962d3559969a1448f01dc6b45aedf4b1ed9c3406d54988db4bed8c070cf3de4dc1ec94c71a0a78ddda0944
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPc:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdrB

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2648	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2992	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2992	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2992	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2992	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	28
PID 2984 wrote to memory of 2648	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2648	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2648	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	29
PID 2984 wrote to memory of 2648	2984	26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26c8a6ff09b17b16b6579bbfe354f608_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
55d5467290db03ea1a4ff1cb0a39c80f

SHA1
f3450609d6531c1a171fa33ab969a4c0022b2a63

SHA256
5604051805434e1aca66710f98932121f2292aebc74417fa54bf902f37acdcbf

SHA512
d2b23e5cba96fdb792c76e164a04b1b390e9cde706dc3ab77272cf505f903094027120cada2fcc0dd7bd3ddd3113338603d914ddeaf87feb06e7660ee75d2a2d

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
60KB

MD5
8d1e38cf6bc516316a117f8305b70ef8

SHA1
77d01b986f479664c2b38f095e8c8f260741a8c4

SHA256
3afb7439c92e40b014202757ef5a7a0abee68056ad77d85ee7ab6178179b8823

SHA512
553c4e1c6802c5632bf0c82cf5f02af7034d0c1e3f597c5b879d946bc02211f267d9b43e4502485e218970682deaeab9f1d9c957c6804679640ebd3bb24ed80f

Download Submit
memory/2984-0-0x0000000000810000-0x0000000000845000-memory.dmp

Filesize
212KB

Download
memory/2984-17-0x0000000000810000-0x0000000000845000-memory.dmp

Filesize
212KB

Download
memory/2992-16-0x0000000001130000-0x0000000001165000-memory.dmp

Filesize
212KB

Download
memory/2992-20-0x0000000001130000-0x0000000001165000-memory.dmp

Filesize
212KB

Download
memory/2992-22-0x0000000001130000-0x0000000001165000-memory.dmp

Filesize
212KB

Download
memory/2992-28-0x0000000001130000-0x0000000001165000-memory.dmp

Filesize
212KB

Download