urelas | 77d784e0eb7895ce858b6d39209c3c5853d9262a312f58131f57be03db55d8b9

Analysis

max time kernel
138s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe
Size 96KB
Sample240722-23m6dstcma
SHA256 77d784e0eb7895ce858b6d39209c3c5853d9262a312f58131f57be03db55d8b9
MD5 652a0f78ee588ee8bd3fa23f7110ca0e
SHA1 80b7dc8816c01efd6c89486bb42f520479bd3104
SHA512 eae9784ba6cc72a85d56fd23c468fc5f41691208ced05aa4c805fa4537ed328ac6c54ec55ff3894765ee499aa1e8ebe16651588fbe44f3509bd3a53ff4a54edb
SSDEEP 1536:nwhq8V9IpPf2lgiIJ4pivJnuNVueC39GdBR3M9cRzqipU:nqV9MziU4piRun7C3CP3MgxpU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.209
112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
924	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 924	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	89
PID 4784 wrote to memory of 924	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	89
PID 4784 wrote to memory of 924	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	89
PID 4784 wrote to memory of 3568	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	90
PID 4784 wrote to memory of 3568	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	90
PID 4784 wrote to memory of 3568	4784	652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\652a0f78ee588ee8bd3fa23f7110ca0e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d
MD5 02167b944a214fee3d34f9a7e356dc6a
SHA1 ca5b3f38a7151268726401593eb35f9b67bdde97
SHA512 c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 96KB
SHA256 0b82ca72e2224c300261e98bc7fac9fb5bf2024aef2271cd5b95f114f0e333fc
MD5 4132105e97bb3abc9f2902a7b2cdc415
SHA1 31a5af679afdbf08872ab12a110db8c6ed7b9234
SHA512 0de6674ba80c195f692c7c7349e3d38ed35efbf31638a8e4510c5f2d66170f16a821cbe43972850d955c646ff80e51190e5a8aa1120988d9dbfb2d39b9c38546
SSDEEP 1536:nwhq8V9IpPf2lgiIJ4pivJnuNVueC39GdBR3M9cRzqipi:nqV9MziU4piRun7C3CP3Mgxpi
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 a493cf3626cc334b714a8d605e8d384cb0da4745c7634e674455ae9a076b8efb
MD5 62bf506ca8f77592a030c59d7164df5c
SHA1 3cb9790fb8f946f00415201edcc06d8af4442681
SHA512 cff87d339ac72db208340a54579a9a691c0e352cbd92d36f38b28ea6530eeb07e5ff1b96d21f1a1b31edfce71b134e557f166258b6d634f910009132bc9733a4
MD5 SHA1 SHA512

Submit Download

memory/924-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/924-21-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/924-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4784-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4784-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads