urelas | 568f1d7c0db4ad571761dd031f9bc579d1c38a1dc0b06acfb6376e44d2770a36

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe
Size

199KB
MD5

0502da103e8570ee1d53804fd17d1b87
SHA1

177c635964faeb30670e7a6e2e65494068049204
SHA256

568f1d7c0db4ad571761dd031f9bc579d1c38a1dc0b06acfb6376e44d2770a36
SHA512

b0b67b82a256320ed4bd9fb3c25b28ad69718a1575af010afff17ab42d63f708dcd1cc96b867ef1d0b9261d154ed755a498fbce2aeb2ff13739bbc389ce869e3
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhAu:gExhk7rh7NEOIYWlPM6r6X

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2768 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2768	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe

description	pid	process	target process
PID 4408 wrote to memory of 2768	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 4408 wrote to memory of 2768	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 4408 wrote to memory of 2768	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	biudfw.exe
PID 4408 wrote to memory of 4060	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe
PID 4408 wrote to memory of 4060	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe
PID 4408 wrote to memory of 4060	4408	0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0502da103e8570ee1d53804fd17d1b87_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4408

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
199KB

MD5
e5325a9c7274330ba35dc7c194916493

SHA1
c1f1935f711e39577a717a9e98a4cca5a3311200

SHA256
5c2d4e00380b703b94c63a494c1878252634cdc7adf99c5f07e02da09261b468

SHA512
3b2b62250551d1a69e0f91cdc124355e0b59e81a0e61ee79f422ddd4f8f55d70124a4c48cf6679f17c117c8888530f5a667e2576569700ae0c4441d82675c408

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
302B

MD5
a03fedfa833392b2040c66c79ec0345d

SHA1
39303bd96db8fe92419e68431c0b85741da1f86c

SHA256
4803ac5f36fed379c8b3745585329412e0db69e5a7cf556e0d7dea1daec4b99f

SHA512
5562e324d6e82311f61b2330d2468532cabc37eb116860f7943a167df4aaba8cd1a4fd25d8f235ddaa859051e4e423da9a07d148e5b05f1014afa7079f48e279

Download Submit
memory/2768-13-0x00000000004A0000-0x00000000004D4000-memory.dmp

Filesize
208KB

Download
memory/2768-18-0x00000000004A0000-0x00000000004D4000-memory.dmp

Filesize
208KB

Download
memory/2768-19-0x00000000004A0000-0x00000000004D4000-memory.dmp

Filesize
208KB

Download
memory/4408-0-0x0000000000AE0000-0x0000000000B14000-memory.dmp

Filesize
208KB

Download
memory/4408-12-0x0000000000AE0000-0x0000000000B14000-memory.dmp

Filesize
208KB

Download
memory/4408-15-0x0000000000AE0000-0x0000000000B14000-memory.dmp

Filesize
208KB

Download