urelas | 568f1d7c0db4ad571761dd031f9bc579d1c38a1dc0b06acfb6376e44d2770a36

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe
Size

199KB
MD5

0502da103e8570ee1d53804fd17d1b87
SHA1

177c635964faeb30670e7a6e2e65494068049204
SHA256

568f1d7c0db4ad571761dd031f9bc579d1c38a1dc0b06acfb6376e44d2770a36
SHA512

b0b67b82a256320ed4bd9fb3c25b28ad69718a1575af010afff17ab42d63f708dcd1cc96b867ef1d0b9261d154ed755a498fbce2aeb2ff13739bbc389ce869e3
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhAu:gExhk7rh7NEOIYWlPM6r6X

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3016 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2216 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

pid process

2440 0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3016	cmd.exe

pid	process
2216	biudfw.exe

pid	process
2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

description	pid	process	target process
PID 2440 wrote to memory of 2216	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 2440 wrote to memory of 2216	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 2440 wrote to memory of 2216	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 2440 wrote to memory of 2216	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 2440 wrote to memory of 3016	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe
PID 2440 wrote to memory of 3016	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe
PID 2440 wrote to memory of 3016	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe
PID 2440 wrote to memory of 3016	2440	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2216

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
302B

MD5
a03fedfa833392b2040c66c79ec0345d

SHA1
39303bd96db8fe92419e68431c0b85741da1f86c

SHA256
4803ac5f36fed379c8b3745585329412e0db69e5a7cf556e0d7dea1daec4b99f

SHA512
5562e324d6e82311f61b2330d2468532cabc37eb116860f7943a167df4aaba8cd1a4fd25d8f235ddaa859051e4e423da9a07d148e5b05f1014afa7079f48e279

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
199KB

MD5
87cfed4ab91d174f4ca5436284211ce4

SHA1
2f3c7f10a530877ca19ffc0996cca6971af21d22

SHA256
7ec2025357b3467e5c7034c88db08fcd0fb83db7181edbcdac4a148bb2cfd7c0

SHA512
1ecc9adb2615fb644d89324495b724942fd2e832aa909782c5ff1b6f508dfd986354aa26f9878c1f2de800cf436380af05016d598044f303e8f8aa5915eebddb

Download Submit
memory/2216-10-0x0000000000920000-0x0000000000954000-memory.dmp

Filesize
208KB

Download
memory/2216-21-0x0000000000920000-0x0000000000954000-memory.dmp

Filesize
208KB

Download
memory/2216-22-0x0000000000920000-0x0000000000954000-memory.dmp

Filesize
208KB

Download
memory/2440-0-0x00000000012D0000-0x0000000001304000-memory.dmp

Filesize
208KB

Download
memory/2440-9-0x0000000000A30000-0x0000000000A64000-memory.dmp

Filesize
208KB

Download
memory/2440-18-0x00000000012D0000-0x0000000001304000-memory.dmp

Filesize
208KB

Download