urelas | 4877cbaf0190e4ed1875b13f67b892bc05f0ba9de61a98220501e129af64ebb1

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe
Size 184KB
Sample240403-ev7thafg7w
SHA256 4877cbaf0190e4ed1875b13f67b892bc05f0ba9de61a98220501e129af64ebb1
MD5 9fe1f3a56fbe50ccbd304b98111b955e
SHA1 6f74bd49dcc8b93c5214746cd572a1055829e3ea
SHA512 1f711159bf068c950f1d5460bed0c200ff3d225e3e05c40f540fdde4f0f6f09311936d5830fc07d91036b32f1420df89d8539f090b0392e937fb18cbaaeffe37
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgWh:Thuk8QsH47nW5ppkoI4KEAUgWh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 5108	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	95
PID 3912 wrote to memory of 5108	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	95
PID 3912 wrote to memory of 5108	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	95
PID 3912 wrote to memory of 4776	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	96
PID 3912 wrote to memory of 4776	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	96
PID 3912 wrote to memory of 4776	3912	9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9fe1f3a56fbe50ccbd304b98111b955e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
MD5 ede6388dfbb03ff576508b085d03e793
SHA1 71d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA512 097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 184KB
SHA256 420650d502337e3833934b71f63fe0e2e4f1f0011ccdbf473c0486dd4fd43301
MD5 248d16743ca4707539bdf9ec48d03b28
SHA1 fd57c63da57bac24797e59272225905da2f35ed4
SHA512 592127089dae5e57235403db428365695e36bfe27ba730b24c379bafea6cbea89af926dd06e2bd7148bff51a9562872ed134f501c0d75f43cf322265c93224ed
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgWt:Thuk8QsH47nW5ppkoI4KEAUgWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 a8489c5133037219277b518e04cbf061520892f43c45c3840ae12de0acf587e9
MD5 55ffcc771d389487b320c01da23abf48
SHA1 5e5eb80ba1fe48dd40db5252bf7713469df6ce07
SHA512 c90500dcc51c7b88e19b3be3b3c6e1573d99cf71e8cd8a6c253f38951ffec19a0a7a8bbcdf776dc394e01cb4bed356f6798134dad0f528b611e5d6376f5c5a20
MD5 SHA1 SHA512

Submit Download

memory/3912-0-0x0000000000950000-0x0000000000981000-memory.dmp

Download

memory/3912-17-0x0000000000950000-0x0000000000981000-memory.dmp

Download

memory/5108-12-0x0000000000D90000-0x0000000000DC1000-memory.dmp

Download

memory/5108-20-0x0000000000D90000-0x0000000000DC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads