urelas | 71f089dfbed88004b3a6c12d01823a26ad9415d1c20950808e49aa1be0372bf4

Analysis

max time kernel
121s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe
Size 185KB
Sample240403-zhcstacc3z
SHA256 71f089dfbed88004b3a6c12d01823a26ad9415d1c20950808e49aa1be0372bf4
MD5 a62c6ab195a488a4add29693a07c2b26
SHA1 fbfdfd6e88c7667a22e228311f458004ecfa519f
SHA512 f7ae4a80c57f6aff3a685e232a56375c9a8309dcf8a9f2d1b72161676f5b125ad7e0cd29ab195b36bea479a50b5aacf68a44a5dc6834b365e52b6208811947d2
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgWq:Thuk8QsH47nW5ppkoI4KEAUgWq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4456	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4456	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	98
PID 4940 wrote to memory of 4456	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	98
PID 4940 wrote to memory of 4456	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	98
PID 4940 wrote to memory of 4768	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	99
PID 4940 wrote to memory of 4768	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	99
PID 4940 wrote to memory of 4768	4940	a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a62c6ab195a488a4add29693a07c2b26_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
MD5 ede6388dfbb03ff576508b085d03e793
SHA1 71d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA512 097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 185KB
SHA256 81974391721038d0a86ccfdc866ac7f1c42484cf3b99c0d110e274eed0881feb
MD5 1f5e82c366a80ce3e4afbe1a8057319b
SHA1 8145ac4f7e63c2244448ee1e60f8a0e22a8e2aa1
SHA512 23a10356664eaddc32e8888744c907ef64bfefede246b4a96b9768f06cb72586b6b3c7da625a0e839e311bafad85e0c763b699d4a51eb1a400a182f5b6bc508f
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgWG:Thuk8QsH47nW5ppkoI4KEAUgWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 3242a7b195c82c11a0563f99c02e378efbf90b1061b03a6c9a13bfbe88e707e8
MD5 c499375a8a78b3d00c9bf20e06f8ce1b
SHA1 6891a1ae89d079065b83c6aebbb59b740949e4c7
SHA512 4397c582ac5f3c64d4b20093116d6d39af2d43f0247b885fdf78e029c3bd8b975ef411f1820f490489c19f469cfa22d251ea2fe1bd9a44699d841eab8e0978b9
MD5 SHA1 SHA512

Submit Download

memory/4456-14-0x0000000000490000-0x00000000004C1000-memory.dmp

Download

memory/4456-20-0x0000000000490000-0x00000000004C1000-memory.dmp

Download

memory/4940-0-0x0000000000590000-0x00000000005C1000-memory.dmp

Download

memory/4940-17-0x0000000000590000-0x00000000005C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads