urelas | 9de977476dcea4fd3bd8dbd894f510f3eac2a34017aefea3f84415b686b2dea8

Analysis

max time kernel
90s
max time network
94s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe
Size

59KB
MD5

2c2cc71c4e3075d4cfce5efa94e45ed2
SHA1

a1b01ea1e74c53a47f344af2e538aef9823772aa
SHA256

9de977476dcea4fd3bd8dbd894f510f3eac2a34017aefea3f84415b686b2dea8
SHA512

de6640bfecacd87d95f8f810198753608b85d1b84ad394047dcb0af149bf7d5f6dee8f20be1e20b0014c85b3ef9ad64b4d44717c7cca9165ac8f5a2d85b4e294
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP/:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdG

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2264 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

924 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe

pid process

2268 2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2264	cmd.exe

pid	process
924	biudfw.exe

pid	process
2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe

description	pid	process	target process
PID 2268 wrote to memory of 924	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	biudfw.exe
PID 2268 wrote to memory of 924	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	biudfw.exe
PID 2268 wrote to memory of 924	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	biudfw.exe
PID 2268 wrote to memory of 924	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	biudfw.exe
PID 2268 wrote to memory of 2264	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	cmd.exe
PID 2268 wrote to memory of 2264	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	cmd.exe
PID 2268 wrote to memory of 2264	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	cmd.exe
PID 2268 wrote to memory of 2264	2268	2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c2cc71c4e3075d4cfce5efa94e45ed2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:924

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
ab993a7b1bcb454a6cba5ed839b75155

SHA1
0d58ed122b857ac4d77c1a293de4f702b9e56318

SHA256
08393a97fda3295e83ffb0e2c126f4328924835dc84d3929d8cc404f8eb38482

SHA512
c0eb149143bbb16a9fd55189a9ad61d43240eb9fd34331d6f5bf276faf7fb6e9c83d3795bee8ed48319670fbcf5da5ccd0edfff9aee4d3a31894f8f79c0ce226

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
59KB

MD5
ed4507b8fabb4f6f1521834d05c7f100

SHA1
e41414ba7ec62f773ee5b2e0892e617fc7c27c8e

SHA256
bab06f75f35c60b370a8111394fbb93b82ebe67f2b3cf1b8a043aa6d66ee16c7

SHA512
ade3b99efc1688825289dbeedabfc4fd11245233b969c6078aab42db98cb10fefd09d93e26cfe7f56cc347e05e7aea2333a9e5b5a66c6437a5aa2ec82fea5996

Download Submit
memory/924-10-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/924-21-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/924-23-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/924-29-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/2268-0-0x0000000000C40000-0x0000000000C75000-memory.dmp

Filesize
212KB

Download
memory/2268-9-0x0000000000B60000-0x0000000000B95000-memory.dmp

Filesize
212KB

Download
memory/2268-18-0x0000000000C40000-0x0000000000C75000-memory.dmp

Filesize
212KB

Download