urelas | 27fc491e00d6926032b5a09034b973b7124c9c97e81f44783e9d840197f9b210

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe
Size

59KB
MD5

3bdcb1d115cae19ece1818cf857c838c
SHA1

d5def669b4379a6076e55582cb61ae90f0a8bee1
SHA256

27fc491e00d6926032b5a09034b973b7124c9c97e81f44783e9d840197f9b210
SHA512

84b80d7e761fd2b01f89bbfc5699212f32c7defb5d382e10d97ca36d569c04924a3a4ca619465cf64729a8ff987007841a1551de0cc918579a9b321aebda193c
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPE:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd5

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2364 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2004 biudfw.exe
Loads dropped DLL 1 IoCs

Processes:

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

pid process

2180 3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2364	cmd.exe

pid	process
2004	biudfw.exe

pid	process
2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

description	pid	process	target process
PID 2180 wrote to memory of 2004	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 2180 wrote to memory of 2004	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 2180 wrote to memory of 2004	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 2180 wrote to memory of 2004	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 2180 wrote to memory of 2364	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe
PID 2180 wrote to memory of 2364	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe
PID 2180 wrote to memory of 2364	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe
PID 2180 wrote to memory of 2364	2180	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2004

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
a05c3fbd41a913dee76c59918b7a57ee

SHA1
3cdc7ee196c5f0c49eb8f2cabc6c6f8571105ce6

SHA256
52cb2ca119096ae7c4247aa85f8838ca7a407ba1f2be195663d22e797d84a420

SHA512
bc2d22dbeb689da2c9120e2ad3b9265f9a29f9bfb044514ce1f643dbe85e16c8496f03351fcf0e1dc9a79cc32c20ef2e7f9204e2aae96b5b7ea65484858b339e

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
59KB

MD5
281aff5e6acc644323292cdec3fb80fb

SHA1
b3c29504e5efc0b82e20f5db6164de44e70fe39d

SHA256
4cc517147ec4cca50ccd663f26ad720c80943137f37161c5c87df0b222b2e589

SHA512
addfe9d23245cc8f7df7297639de90dbf8095183f570bb669ac026b43f0068131ff7e0cf63b8f5c2efc62d30f1907ec9cb11bd05a5b2edd665ff530bbf21b0a0

Download Submit
memory/2004-16-0x0000000000CE0000-0x0000000000D15000-memory.dmp

Filesize
212KB

Download
memory/2004-22-0x0000000000CE0000-0x0000000000D15000-memory.dmp

Filesize
212KB

Download
memory/2004-24-0x0000000000CE0000-0x0000000000D15000-memory.dmp

Filesize
212KB

Download
memory/2004-30-0x0000000000CE0000-0x0000000000D15000-memory.dmp

Filesize
212KB

Download
memory/2180-0-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download
memory/2180-6-0x0000000000960000-0x0000000000995000-memory.dmp

Filesize
212KB

Download
memory/2180-19-0x0000000000850000-0x0000000000885000-memory.dmp

Filesize
212KB

Download