urelas | 15de7f897658f8e6da8a3e45f6600ac1d460a2c64f355c06763ee6330ce0e694

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 08:49

Target

b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe
Size

379KB
MD5

b7ba7e9cb82e8bb14a8e771305588b4d
SHA1

4579e6f1ab1f36b52b11de23273760250f12bf30
SHA256

15de7f897658f8e6da8a3e45f6600ac1d460a2c64f355c06763ee6330ce0e694
SHA512

624f6ba1fa1d4c9805d1592324db68e001abf7dcc6eb3c78005fe66a00bd8a956c70364bfc017e2960a9f9d45874d3d5bba570d5bfae45750ae20440691b156e
SSDEEP

6144:AxBWeMRygxDLbHxlSBxzJMotBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGtp0:Y3MQIDKJQq+Xxvo0U+d3s/fCX0h

Score

10^/10

urelas trojan

Family

urelas

121.88.5.183

218.54.30.235

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 2784 WerFault.exe b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe

pid	pid_target	process	target process
2924	2784	WerFault.exe	b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe

description	pid	process	target process
PID 2784 wrote to memory of 2924	2784	b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe	WerFault.exe
PID 2784 wrote to memory of 2924	2784	b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe	WerFault.exe
PID 2784 wrote to memory of 2924	2784	b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe	WerFault.exe
PID 2784 wrote to memory of 2924	2784	b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b7ba7e9cb82e8bb14a8e771305588b4d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 116
  2⤵
  - Program crash
  PID:2924

memory/2784-0-0x0000000000B50000-0x0000000000BB5000-memory.dmp

Filesize
404KB

Download