urelas | a7e5ca6a4db0dbb844c2e0e33671834b108dd25b4a64de5cc24f5bb74da1cd50

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:58

Target

65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe
Size

476KB
MD5

65c6e7c15bd526a408a9e72c066308c6
SHA1

f88598dca96506052441418eb50974d86cdb0008
SHA256

a7e5ca6a4db0dbb844c2e0e33671834b108dd25b4a64de5cc24f5bb74da1cd50
SHA512

9bdebed3c5a2dc779155c5ce629c3125af01286a9f159d2e5e0c60c735b296915e5e43b4af1adf5bd038d58d608c7b90623e17133613e5a58b4491e649fac3e7
SSDEEP

6144:LqXAoQT5Tr9R0HN/3w36EnCYLTcz6MY5NYnE/QhyjxJBErrZAWkPW5oeNtLjph:mQRI/3w36EnCYcFE/iydJai/WZtn

Score

10^/10

urelas trojan

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 2884 WerFault.exe 65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe

pid	pid_target	process	target process
2960	2884	WerFault.exe	65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe

description	pid	process	target process
PID 2884 wrote to memory of 2960	2884	65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 2960	2884	65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 2960	2884	65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 2960	2884	65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65c6e7c15bd526a408a9e72c066308c6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 164
2⤵
- Program crash
PID:2960

memory/2884-0-0x0000000001090000-0x000000000110F000-memory.dmp

Filesize
508KB

Download