urelas | a7306aaee21e8a4ff56d55dd4f960d336eb5364dfe46292e2c4acde05b89b803

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe
Size 200KB
Sample240724-nfmpfswhnb
SHA256 a7306aaee21e8a4ff56d55dd4f960d336eb5364dfe46292e2c4acde05b89b803
MD5 6b6bbf33ce0cc8f41a57c5a69872ae01
SHA1 4fc2ffb5fbf3e4b5255c5d8ae5ce872fa0b364a0
SHA512 309bfd345978f8e458d6f67b01faf12790958d706c9e48b1e8f871ceb9a303a13a48f5de8a6a7425c2fd7655975ee52419eb1333ae324b54f9f3cd35fb4ed305
SSDEEP 3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhAE:gExhk7rh7NEOIYWlPM6r6h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76
218.54.47.77
218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
5052	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 5052	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	88
PID 5044 wrote to memory of 5052	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	88
PID 5044 wrote to memory of 5052	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	88
PID 5044 wrote to memory of 4360	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	89
PID 5044 wrote to memory of 4360	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	89
PID 5044 wrote to memory of 4360	5044	6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6b6bbf33ce0cc8f41a57c5a69872ae01_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 200KB
SHA256 eccd9114c19af7b0e886bbb7c4f4183765c98acc33e5b50ccbf65d01998a7315
MD5 b1f760c6db004c9278f3c16c2c4f8ccd
SHA1 2ceb208c8b5a106b359bd259e5683889cd07e39d
SHA512 7f83a57792b611de0da756207a60ec108f104e4e02e1f1ef7e05eb455351a31265c6cf57a87a74f0026d02dc520268cfeb4f1d834114a50821043df14b5168d7
SSDEEP 3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhAP:gExhk7rh7NEOIYWlPM6r6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f
MD5 2776cde4761cefd1198f4712989957b1
SHA1 c801245a080524e704e8e3da95700e58e9d1ca3c
SHA512 bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 58bec0148cc41a45a3bb7fe468a821940e308344f873f3321a9091c80b5e8a54
MD5 8d543a45d7992606eef0ba3644c22074
SHA1 f5e4b29d184879e74d4db27664123e626baead74
SHA512 c6af74cc30d0a4a20d3c9b401887c384a7660ef12085d62264466a5774873fcb3679b1cb1724d995c37c9e42f86960d3b52ef661979dd66fa6d3ba5084d341c5
MD5 SHA1 SHA512

Submit Download

memory/5044-0-0x0000000000260000-0x0000000000294000-memory.dmp

Download

memory/5044-14-0x0000000000260000-0x0000000000294000-memory.dmp

Download

memory/5052-11-0x0000000000370000-0x00000000003A4000-memory.dmp

Download

memory/5052-17-0x0000000000370000-0x00000000003A4000-memory.dmp

Download

memory/5052-18-0x0000000000370000-0x00000000003A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads