urelas | b2381c978e4ce6f6a73bac053e795640f8dab725fde79f3c2a4f0236adf8e919

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe
Size

108KB
MD5

1f7a7f5d6688cd18177ead9609899aec
SHA1

2028d847783388c8f5a5bdb6b8aa9b5ae76df65d
SHA256

b2381c978e4ce6f6a73bac053e795640f8dab725fde79f3c2a4f0236adf8e919
SHA512

509ec9330d5ecf667393ac2d34fe97d4d4855d45b42e357c12c37f78bdf54ba7a673da12a35197c93b155fea0adbbd4e2c2f12164033b8a6f6564bb78264c49e
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjj:4tCc+/h0fmSid81L64TGVj

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2352 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

1880 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

pid process

836 1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2352	cmd.exe

pid	process
1880	biudfw.exe

pid	process
836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

description	pid	process	target process
PID 836 wrote to memory of 1880	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 836 wrote to memory of 1880	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 836 wrote to memory of 1880	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 836 wrote to memory of 1880	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 836 wrote to memory of 2352	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe
PID 836 wrote to memory of 2352	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe
PID 836 wrote to memory of 2352	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe
PID 836 wrote to memory of 2352	836	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:1880

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
302B

MD5
d679d6599fe845a76af2bb0a7b18a3d2

SHA1
0243cbe98a2b0cba3345f3dbb12bc225181ca6a9

SHA256
ded109e239330881807104ea5d3df155259683f45a3ba0c9f393952c8f445ef6

SHA512
f108bbdc0809148b2dfbad7982a07829234bea1dff7bd5641181e514ceb8e061d4eb34ee2cdeb1163cba6a468bf24d5d8cd9775ee447e13e31cfe0a07c4fbd4c

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
108KB

MD5
31a75a612525de1bd39f256361b38de9

SHA1
ca3e7d68535f3e573f94f202346bd1abe3348300

SHA256
e6d56bc856638dc5e0d2ba91797b80b2f7e8c492266640f1d4b410eabb042bc4

SHA512
d4e56f9083f5cca9a4b90c84c22de241e9d8beff493d87f1dbf81566869cb8a3f05bac04b3922f12c1032f1c9ad883ce54d3f7724ef0adb5d92d5ad20f9a67cd

Download Submit
memory/836-0-0x0000000000E50000-0x0000000000E74000-memory.dmp

Filesize
144KB

Download
memory/836-9-0x00000000006B0000-0x00000000006D4000-memory.dmp

Filesize
144KB

Download
memory/836-18-0x0000000000E50000-0x0000000000E74000-memory.dmp

Filesize
144KB

Download
memory/1880-10-0x0000000000040000-0x0000000000064000-memory.dmp

Filesize
144KB

Download
memory/1880-21-0x0000000000040000-0x0000000000064000-memory.dmp

Filesize
144KB

Download