Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 15:11

General

  • Target

    80f81d74d457c942e265a5853eac035e_JaffaCakes118.exe

  • Size

    348KB

  • MD5

    80f81d74d457c942e265a5853eac035e

  • SHA1

    bac98bdefce7d0ea78847708c118725efd00bd52

  • SHA256

    ef61c13c329ad94a3c49ff59a9e16a83fdb7f5b5de7a87731af72ff99d1cb3ae

  • SHA512

    25c0271362a96a080104cbfcc415298dff435dba5a985ec355c4d202c8069cf7ddcccc16e883e860339c353592d62f0670548c56959295a9223d34bcfbe813eb

  • SSDEEP

    6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZ1:A0G5obGGraOpUWlpa

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.226

218.54.31.165

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f81d74d457c942e265a5853eac035e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\80f81d74d457c942e265a5853eac035e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\laryc.exe
      "C:\Users\Admin\AppData\Local\Temp\laryc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Users\Admin\AppData\Local\Temp\loxony.exe
        "C:\Users\Admin\AppData\Local\Temp\loxony.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Users\Admin\AppData\Local\Temp\ynmif.exe
          "C:\Users\Admin\AppData\Local\Temp\ynmif.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1704
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:692
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    47f5f200f3e78591ff0c50a873215f2d

    SHA1

    69d23d45e950ffe81c5d2b44fd34cdcbb6dd5e3f

    SHA256

    6645fb979ad2e03f843c3531cb5462bd44860ff6240bff6f61803ed95f002115

    SHA512

    aa810d18fa0dc3fbce38cdbf32ed15a7a0e7c8f00592f45d5fc88e88ad2aff1debeceb537e44380d67882d822dc1cb5b4c3bfd132c71680c323a187582dcb8d0

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    70de57ca928f46226e571c5666d379be

    SHA1

    bfe14359bcd781ae68997cdcc485e1f92e997b26

    SHA256

    11a41402a05357928bf3e69ce9ccd6e257413caba26827e6c72323d8bac842aa

    SHA512

    d565762be3c32cef29150ea25974e87131be48372e46a5e3ac62f38fc900677e4d9d537f0c5dc84788f1d540bd2713950d748b8ae0f0b37d2909911a1cbff132

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    93d1c8d116115dc5f9feba8bd3eb8605

    SHA1

    16c1397fb352a557118aba27e9927fdd7741f08f

    SHA256

    1f58f63cdec92450ee4bd90025b166f0f0b91e0aa3d63da2460f06b1e97ddb0a

    SHA512

    28babed5a3a24bc02aca74f54b826ffd11170846d3b0fd6b88415bb59336481dd482f2ae1524e3a7f8acb50331bb509db218a7cf3e337709e68466d456030137

  • C:\Users\Admin\AppData\Local\Temp\laryc.exe

    Filesize

    348KB

    MD5

    373346bc6b19ff26c4a48009a8632722

    SHA1

    76ffbb430c13a0baf84bf57c3c826d496ef81d13

    SHA256

    433b0855c44f8a288e68db02179b8fd20020d5f9014b3d515e0bc95d812f02e8

    SHA512

    250e2cd091dfb6f8ffd77e9eac1057ce9ecf1e5e6096ad38a60ccf93e6df00eb506076e09a8707d3ec8e70b835ca2a3b2ce65c7c4b9b1fcc23066d2c9fb6e9da

  • C:\Users\Admin\AppData\Local\Temp\ynmif.exe

    Filesize

    115KB

    MD5

    5590b49cfdd63901bd157d5943524a06

    SHA1

    537cf14d7c4f42dcfbca03b1af68bc511522dbf3

    SHA256

    78791e00e39f19f21d7a4835133d66e13b925d5ccc4de1d1080d3ee3a969064f

    SHA512

    ac19e58c269f69d84689e1a76c9cbb0f00459d9c2a4e72ff97235fdd28038c089b0212d904e6db1d679caf69e0f816e2fcb6ef7aa3927f9259db8d7e669ee660

  • memory/1704-57-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-65-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-64-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-63-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-62-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-61-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/1704-60-0x0000000000A00000-0x0000000000A82000-memory.dmp

    Filesize

    520KB

  • memory/2528-33-0x0000000003660000-0x00000000036BC000-memory.dmp

    Filesize

    368KB

  • memory/2528-35-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2528-21-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2528-32-0x0000000003660000-0x00000000036BC000-memory.dmp

    Filesize

    368KB

  • memory/2896-56-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2896-37-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/2896-34-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/3016-18-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/3016-2-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB