urelas | d394346f7300663086f23fbb38abaaaf4de0c9d419101566fb79252ed27fe5b6

Analysis

max time kernel
132s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe
Size

124KB
MD5

254bb132ad03ff0fa6c8062545b47ea6
SHA1

e4ddd6bb4e8328c929bc198d85f5526c62a94f14
SHA256

d394346f7300663086f23fbb38abaaaf4de0c9d419101566fb79252ed27fe5b6
SHA512

9968bfa8c95025d858bc75358048d729a8ca5a54d279a0ecab6e48cf880852908757664d269d4262c0a08127d4dd4c8d7af7786fdcb8ebdddbdc92ad03b44e21
SSDEEP

1536:DVih9jjOABjWAqUffzNoBcTwE/sNW4Am8NsuPz4cnSXsWjcdy6YAiQ45sIsb/:DVSRBPCoLY5RIzNdy6YO45U/

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1592	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1592	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	89
PID 1048 wrote to memory of 1592	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	89
PID 1048 wrote to memory of 1592	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	89
PID 1048 wrote to memory of 4888	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	90
PID 1048 wrote to memory of 4888	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	90
PID 1048 wrote to memory of 4888	1048	254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\254bb132ad03ff0fa6c8062545b47ea6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
124KB

MD5
fb9bd7984c1c813182d484b257faff9c

SHA1
7358f264fa68b21b46064733013e029a0f6e0abb

SHA256
bf9694ea3128544b9401af926060bec16cd977629cbc4215fdfba1595b24ca32

SHA512
b7980e3179c5c35d247a6ad135b9760351eb2c05e5034f9396b838815d26ac508d79fc35ed266486baadab8c289e35837ca9ea2e99b66a89d51266b78da0c6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
b4a86880004da8726288d7ec954885a8

SHA1
1bab1cfbdc2c540246210bc7852f8fe7e8357b31

SHA256
c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46

SHA512
22758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
eaf632ed45a9da1002a0543d472ceacf

SHA1
f741fb7500c46ba498e5dc4b0ef5c0f64077b925

SHA256
d95a8bc27e3722b2657a293d7889d3835a74bcc41e36b03879881f81bc62dbff

SHA512
2ed18038ca02cdd484f925327da21fe6b135ae153a878bf07b300bd4a4c24e679feb0c66b4b2dfff8d4e5625a0040116a4400885c8e2fc8c2c4c0b21461f6bfa

Download Submit
memory/1048-0-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/1048-14-0x00000000006A0000-0x00000000006C8000-memory.dmp

Filesize
160KB

Download
memory/1592-12-0x0000000000F30000-0x0000000000F58000-memory.dmp

Filesize
160KB

Download
memory/1592-17-0x0000000000F30000-0x0000000000F58000-memory.dmp

Filesize
160KB

Download