urelas | 206a904b547eec8a102559b437b3359c77e5c8a9f3eb22abb062dba272f58cd3

General

Target

822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe
Size

557KB
MD5

822db89c7caafdeab59a80d8afedb6a0
SHA1

b345cf37f3a318649a2c9852ebc813e7b1e69271
SHA256

206a904b547eec8a102559b437b3359c77e5c8a9f3eb22abb062dba272f58cd3
SHA512

cebad1b358a7c4d7f39534c1e1807b27ce9aea546424ddd1d0389ea6254cecdd4d698fd945cb9cb7e5cf08e9c4853b356af78972b633ff28af69b1e771b1a500
SSDEEP

12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEyb:znPfQp9L3olqFb

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exejoxyr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation	joxyr.exe

Executes dropped EXE 2 IoCs

Processes:

joxyr.exegobou.exe

pid process

1904 joxyr.exe
1552 gobou.exe

pid	process
1904	joxyr.exe
1552	gobou.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4728-0-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\joxyr.exe	upx
behavioral2/memory/1904-11-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4728-14-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1904-17-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1904-26-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exegobou.exe822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exejoxyr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gobou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	joxyr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

gobou.exe

pid	process
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe
1552	gobou.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exejoxyr.exe

description	pid	process	target process
PID 4728 wrote to memory of 1904	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	joxyr.exe
PID 4728 wrote to memory of 1904	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	joxyr.exe
PID 4728 wrote to memory of 1904	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	joxyr.exe
PID 4728 wrote to memory of 2248	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	cmd.exe
PID 4728 wrote to memory of 2248	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	cmd.exe
PID 4728 wrote to memory of 2248	4728	822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe	cmd.exe
PID 1904 wrote to memory of 1552	1904	joxyr.exe	gobou.exe
PID 1904 wrote to memory of 1552	1904	joxyr.exe	gobou.exe
PID 1904 wrote to memory of 1552	1904	joxyr.exe	gobou.exe

C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\822db89c7caafdeab59a80d8afedb6a0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\joxyr.exe
  "C:\Users\Admin\AppData\Local\Temp\joxyr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\gobou.exe
    "C:\Users\Admin\AppData\Local\Temp\gobou.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
44fed0c3b4f1dca994cc3c29b1379611

SHA1
20cc5a4064b019e1dc84d18f1ec490911059f128

SHA256
87e7c5356c17415ec5c45c665ce57e332e06247cf9fce1b4f837b6ffb3cca22e

SHA512
dd7e1f318571f9441d7609ba1539a7d4b8fa3ac0c1ba94a9a4f2e973cca3e2ef4a11d19d90d72c9aa61f4a4a768fc09a7988d7d2e0e34080945e98b03030dfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\gobou.exe

Filesize
194KB

MD5
9c2f9c319d280c0169f4c9b160d04ac4

SHA1
b9a29858ec6b637b16214ec8687d972fe6980890

SHA256
5986893e19139b1ecf48f4e0c7f58a2fb1d7f8e04f000b765d493861b01cd060

SHA512
4952d743bd402ddb38bb2a6af6e2919e8edd1914fd423fde71ad3154bfafc4ce2fbaba6a008ce3a38e563a2338cd64916e344f1450a6c786d27dfc0c1e02d1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
588aee6068ae3c79c8a4d0458eeaf170

SHA1
3f2836841d483936e5625b56c0bc2526fddd3d32

SHA256
c0c8c79a11de93d00ffb893cc1e857766e8647a403c58c47f9232ec0e6fb1f60

SHA512
6f8a4c32c9b46d5eba9a6149ffd3cf33406437f9b85862f174915a0444d4db39e22a730274a98e3cadab02405c4b230b9673a913e9ca00222e77c0020a75ec75

Download Submit
C:\Users\Admin\AppData\Local\Temp\joxyr.exe

Filesize
557KB

MD5
9b85ac8f57bcb6e0b612f2290864f282

SHA1
de114177eaefa7ee53736eb38b4395a64a70599b

SHA256
8ad4d387c77730a96a11587b0d2f3785c1ea2aa7da560825c645caa3775fa558

SHA512
275c01ee54901d15b8a7a7832897f5242c41f794d28ac08722e4ec4445cbbaef526b9b0c3bdd033c63955990477a2f4ba9eb0eadfe1b383e7964d4362e3bd18d

Download Submit
memory/1552-31-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1552-28-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/1552-27-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1552-30-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1552-32-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1552-33-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1552-34-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1904-17-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-11-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1904-26-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4728-14-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4728-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads