urelas | 27fc491e00d6926032b5a09034b973b7124c9c97e81f44783e9d840197f9b210

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe
Size

59KB
MD5

3bdcb1d115cae19ece1818cf857c838c
SHA1

d5def669b4379a6076e55582cb61ae90f0a8bee1
SHA256

27fc491e00d6926032b5a09034b973b7124c9c97e81f44783e9d840197f9b210
SHA512

84b80d7e761fd2b01f89bbfc5699212f32c7defb5d382e10d97ca36d569c04924a3a4ca619465cf64729a8ff987007841a1551de0cc918579a9b321aebda193c
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPE:nK0GjMeQG3iaQREuVZ6ro29p4YxbKd5

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

2756 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2756	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe

description	pid	process	target process
PID 3480 wrote to memory of 2756	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 3480 wrote to memory of 2756	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 3480 wrote to memory of 2756	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	biudfw.exe
PID 3480 wrote to memory of 4540	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe
PID 3480 wrote to memory of 4540	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe
PID 3480 wrote to memory of 4540	3480	3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bdcb1d115cae19ece1818cf857c838c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:2756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
59KB

MD5
75a868fa549ffbd27dc4fd4f6930b8bd

SHA1
90a2fb0ecea463e1f907be873d63b88e3adbaa2e

SHA256
f1dadb2465d7e9142f1b6a0643200bea057325a1c732fa864c57f8532686c809

SHA512
0dd543597a2a551d440d308822f1706fc92edbb505439ddfe5b5f8f83a770145723b823c4417d4d30ff4d271a2c3f7aad3b922188c20e4c8178762c4e15243b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
a05c3fbd41a913dee76c59918b7a57ee

SHA1
3cdc7ee196c5f0c49eb8f2cabc6c6f8571105ce6

SHA256
52cb2ca119096ae7c4247aa85f8838ca7a407ba1f2be195663d22e797d84a420

SHA512
bc2d22dbeb689da2c9120e2ad3b9265f9a29f9bfb044514ce1f643dbe85e16c8496f03351fcf0e1dc9a79cc32c20ef2e7f9204e2aae96b5b7ea65484858b339e

Download Submit
memory/2756-12-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/2756-18-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/2756-20-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/2756-27-0x00000000000E0000-0x0000000000115000-memory.dmp

Filesize
212KB

Download
memory/3480-0-0x0000000000E80000-0x0000000000EB5000-memory.dmp

Filesize
212KB

Download
memory/3480-15-0x0000000000E80000-0x0000000000EB5000-memory.dmp

Filesize
212KB

Download