urelas | 6c55e6f97bf0bc0f747c41be0f4c24506565e70e4cd905bf6824045ddc8d09e5

General

Target

729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe
Size

50KB
MD5

729e48bf2f40a750ff41f67fa56b550b
SHA1

c6756ad59ea442216b3e66309454588e56a42531
SHA256

6c55e6f97bf0bc0f747c41be0f4c24506565e70e4cd905bf6824045ddc8d09e5
SHA512

1ac108c6c98e1130c9811032b5d5bd485c3ca096470ce49ea5014fd3d0643be8855ad6c304a093e2845ac1ab9424e8d5f1eb3e964bfa4ecf9144a1e5ebcafb6f
SSDEEP

1536:834/PC7Ruz3hRXRASULZ6JKYdbzcmhCZnb:It7R8fU6n8b

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2804 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

mokdhft.exe

pid process

2136 mokdhft.exe
Loads dropped DLL 1 IoCs

Processes:

729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe

pid process

2144 729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2804	cmd.exe

pid	process
2136	mokdhft.exe

pid	process
2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exemokdhft.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mokdhft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe

description	pid	process	target process
PID 2144 wrote to memory of 2136	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	mokdhft.exe
PID 2144 wrote to memory of 2136	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	mokdhft.exe
PID 2144 wrote to memory of 2136	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	mokdhft.exe
PID 2144 wrote to memory of 2136	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	mokdhft.exe
PID 2144 wrote to memory of 2804	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 2804	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 2804	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	cmd.exe
PID 2144 wrote to memory of 2804	2144	729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\729e48bf2f40a750ff41f67fa56b550b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\mokdhft.exe
"C:\Users\Admin\AppData\Local\Temp\mokdhft.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2136

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
39e55c2b5135dd669ad371cc03d79fc2

SHA1
d027fea84a269f8e556dfb5411ac3d01b9311017

SHA256
ecf7b9f0150af34b1d09f4602f0acf31445ff28e40b2411b0e32180bb8672919

SHA512
e75942d900b97d254097d8a44bfde16bdc99cc0f124541316a0987b2fb5433b7b1f12d4eff8b47d05e9068e7a038e4dd92998646448dcb0d6615a81a561ef280

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
73127c3559a32eb804c6d8f327ae0ba0

SHA1
590f961700b6a6c04e3178ce9d4640946776d3de

SHA256
c3ae9c82d4b291a19661cb56fa5fe278ceed1108648c0a74158842406a3ceae0

SHA512
08819d0b571570915fc6b42273d1c7dbd5548b8a1b5a0ca0e40674ddc446d92b53e7fd0f636437fc6adfb81d628e8ed684fc2071732d65189302d646d435129e

Download Submit
\Users\Admin\AppData\Local\Temp\mokdhft.exe

Filesize
50KB

MD5
017887abfe6728b6ceed596d1e4d72f5

SHA1
31b63c2edd8f751b7cd37d3126a5c06b8ab6e113

SHA256
6da61ce47c6adaf6cda6756f4f54153928d46f2f538e5c037cd1a7455c8dcd82

SHA512
4e54883c611c7e6591cafb7a569a7f41db36fc60c39a1a0b99c26d22d650d151c9b8c90a810cb5d744b198e437eb39ab7b03f7da82c684fdddc15bb1dde5768a

Download Submit
memory/2136-11-0x0000000000810000-0x0000000000843000-memory.dmp

Filesize
204KB

Download
memory/2136-22-0x0000000000810000-0x0000000000843000-memory.dmp

Filesize
204KB

Download
memory/2136-24-0x0000000000810000-0x0000000000843000-memory.dmp

Filesize
204KB

Download
memory/2136-31-0x0000000000810000-0x0000000000843000-memory.dmp

Filesize
204KB

Download
memory/2144-0-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download
memory/2144-9-0x0000000000490000-0x00000000004C3000-memory.dmp

Filesize
204KB

Download
memory/2144-19-0x0000000000200000-0x0000000000233000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing