urelas | f3509a5bd15223bc5ca12338551e4a1c3bc93fbe2b0ea89c172b23b772d25802

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe
Size

240KB
MD5

3d76d749455c38a6005c3f38493f896f
SHA1

32d44f57b91de6268c1b09b6c358b36e42ece530
SHA256

f3509a5bd15223bc5ca12338551e4a1c3bc93fbe2b0ea89c172b23b772d25802
SHA512

aeec20df2d3ac3180b88ae8fb9a8cfcb3f25ca5b11f113ba72a5fd230fad132fe89c02c72f0584919db95651a575840d1d0d348345c12f800bfab537747bef17
SSDEEP

3072:K8ASpvo0LKrXEX65ezpxJ2kbJ7mv73E2o/9sY2d:ZASpvo0LKkRzpxJ2kRqroid

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

huter.exe

pid process

2272 huter.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2272	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe

description	pid	process	target process
PID 2532 wrote to memory of 2272	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	huter.exe
PID 2532 wrote to memory of 2272	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	huter.exe
PID 2532 wrote to memory of 2272	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	huter.exe
PID 2532 wrote to memory of 4548	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	cmd.exe
PID 2532 wrote to memory of 4548	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	cmd.exe
PID 2532 wrote to memory of 4548	2532	3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d76d749455c38a6005c3f38493f896f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7295fb9368a0ef278de4b9755bf9fa1b

SHA1
db5fa220d77ed7824ae0a4f822e0ce46010a5d77

SHA256
dd259fcdbf04aa773ede7515d6a83e5b112ed3d9eef4632cf856771bfeaafd98

SHA512
dd1a996311188c0baa54097fc7023f13e71115265fadb9dfa35f2a8d9df8aed1e37bd00ef612577d2eb63ba1b612a7b16a765ebfce3b7c9e7efebe54890eb88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
240KB

MD5
bacffb7da8eda253b323b37d405eb144

SHA1
cff41a202e75b3e4a8ac95b45c3d8b4943470d9c

SHA256
2dcde158c086fbf3b1eae20d02839b4f14624cdd4cb82be784500fcf50d1fe2e

SHA512
56157cdf552b13fd5611485a7d21703546e15aeb72dcc9e9fccbbfef1c13b188a3de7b65ce5ace9d4e2a448dc052509eec2267701ab8d44b07031348ba0cfe56

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
04d58a1c4ef3bbba6b08e855f127d76a

SHA1
08831d7404c25255ce7017856996900ff1d1ba52

SHA256
d1a7d7e4d3ad6f50482cfb17084999319cd947e99e4d1eb6a77050c3e0faee65

SHA512
611dff1e5bf5235f2c23e1a86ba4a2458d55a3976efff064dd43ba73326ea563076b93b734716eb92d9e775d5ea634696e14405935834a48a629ebd6a4394759

Download Submit
memory/2272-11-0x0000000000580000-0x00000000005BD000-memory.dmp

Filesize
244KB

Download
memory/2272-17-0x0000000000580000-0x00000000005BD000-memory.dmp

Filesize
244KB

Download
memory/2272-18-0x0000000000580000-0x00000000005BD000-memory.dmp

Filesize
244KB

Download
memory/2532-0-0x0000000000ED0000-0x0000000000F0D000-memory.dmp

Filesize
244KB

Download
memory/2532-14-0x0000000000ED0000-0x0000000000F0D000-memory.dmp

Filesize
244KB

Download