urelas | b2381c978e4ce6f6a73bac053e795640f8dab725fde79f3c2a4f0236adf8e919

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe
Size

108KB
MD5

1f7a7f5d6688cd18177ead9609899aec
SHA1

2028d847783388c8f5a5bdb6b8aa9b5ae76df65d
SHA256

b2381c978e4ce6f6a73bac053e795640f8dab725fde79f3c2a4f0236adf8e919
SHA512

509ec9330d5ecf667393ac2d34fe97d4d4855d45b42e357c12c37f78bdf54ba7a673da12a35197c93b155fea0adbbd4e2c2f12164033b8a6f6564bb78264c49e
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjj:4tCc+/h0fmSid81L64TGVj

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2352 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2352	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe

description	pid	process	target process
PID 3052 wrote to memory of 2352	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 3052 wrote to memory of 2352	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 3052 wrote to memory of 2352	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	biudfw.exe
PID 3052 wrote to memory of 2196	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe
PID 3052 wrote to memory of 2196	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe
PID 3052 wrote to memory of 2196	3052	1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f7a7f5d6688cd18177ead9609899aec_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:2196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
108KB

MD5
bd1ab2ad78321e064ad8fa374ea9d873

SHA1
ca8e9a05762775f16a93b6afe7b4862940a4a3d1

SHA256
81341eb03746af7c7c9819d6d9e3b9c3da569ab30bca2eb30248caf28e613ef1

SHA512
7a1ca0aee8d6af594e27d17f629ab4ef82d36748bdd1eedaefb662fa99c5b1e5b93440ab75ef60322fbe4b3a9ad89b2b6ea00f600d4ec81dd0d64ea311f3bd2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
302B

MD5
d679d6599fe845a76af2bb0a7b18a3d2

SHA1
0243cbe98a2b0cba3345f3dbb12bc225181ca6a9

SHA256
ded109e239330881807104ea5d3df155259683f45a3ba0c9f393952c8f445ef6

SHA512
f108bbdc0809148b2dfbad7982a07829234bea1dff7bd5641181e514ceb8e061d4eb34ee2cdeb1163cba6a468bf24d5d8cd9775ee447e13e31cfe0a07c4fbd4c

Download Submit
memory/2352-12-0x00000000005B0000-0x00000000005D4000-memory.dmp

Filesize
144KB

Download
memory/2352-17-0x00000000005B0000-0x00000000005D4000-memory.dmp

Filesize
144KB

Download
memory/3052-0-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download
memory/3052-14-0x0000000000730000-0x0000000000754000-memory.dmp

Filesize
144KB

Download