urelas | 3e0c2142867623e11eb199fe38cd9eb2fa3b083333824f111e49486b1aa99782

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe
Size

94KB
MD5

edad22b05b0e64a7fab77bb023afc682
SHA1

700b89b2bcc30c6402a43b04e18cd84b8f62ccb8
SHA256

3e0c2142867623e11eb199fe38cd9eb2fa3b083333824f111e49486b1aa99782
SHA512

f692f7ba199169960b4baf7f66bc83c1c741362eee03922929af5ada18fdcf033e7ce3ee1994fc0b656b01215f2ecef37af52e6ea809242cdeb9bb71bcb90cb3
SSDEEP

1536:nwhq8V9IpPf2lgiIJ4pivJnuNVueC39GdBR3M9cL:nqV9MziU4piRun7C3CP3Mi

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2540	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2248	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2248	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2248	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2248	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2540	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	29
PID 1500 wrote to memory of 2540	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	29
PID 1500 wrote to memory of 2540	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	29
PID 1500 wrote to memory of 2540	1500	edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edad22b05b0e64a7fab77bb023afc682_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
02167b944a214fee3d34f9a7e356dc6a

SHA1
ca5b3f38a7151268726401593eb35f9b67bdde97

SHA256
77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

SHA512
c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
dc3978f28614040da9a9d5e531fa6cd1

SHA1
40dc38519d28da33c1113d6d3f6526221f12525c

SHA256
dd65eb90c824de8164ca26033f1e13cb2c0aeee79cb7928b4f89a7542f3c5483

SHA512
a569e0531567923544274ec319c1ffa69254c51233a59ff8dab94461bc44fb724bc4e3dd8f986b548133dc3a6b21554cab33c826d51a5efbdc2308c04300a3c7

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
94KB

MD5
5c9de41abcd5c44f22c9b067684d32dd

SHA1
84ceb3225977624cc3e4c45f4500e6c8e42435be

SHA256
f7c2a0c70d2d75ec2ba99c107880183b1b03c415198001db53890e31702cc66c

SHA512
41772032d1f34a9987374a4c9b016e05cbfb075f540c2e52fe63a0148ad8440472a9143c1e8d7b880337b7bfd2ced951654e29ca1d21fbf11144e433348e932d

Download Submit
memory/1500-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1500-6-0x00000000026A0000-0x00000000026D6000-memory.dmp

Filesize
216KB

Download
memory/1500-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2248-20-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2248-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2248-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download