urelas | 2d2746b542a4bce7d931d8cea5a6e415b9511db2606dd96f2d54d2228dc08418

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe
Size 189KB
Sample240811-rtpmratcpq
SHA256 2d2746b542a4bce7d931d8cea5a6e415b9511db2606dd96f2d54d2228dc08418
MD5 8ab967641bcc854f6d862112ac9068a5
SHA1 5e723db755a173b8660bb7d9cd9c232c825571d3
SHA512 0c1a7e537f2b8740ba3505395efaaab071745f3b7436d2c479c7373552fc1f11451ff81a57275308694fa0a152062278df454927b4e419040647a43de577168e
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgJ:Thuk8QsH47nW5ppkoI4KEAUgJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1832	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1832	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	87
PID 2972 wrote to memory of 1832	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	87
PID 2972 wrote to memory of 1832	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	87
PID 2972 wrote to memory of 4128	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	88
PID 2972 wrote to memory of 4128	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	88
PID 2972 wrote to memory of 4128	2972	8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ab967641bcc854f6d862112ac9068a5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 779c0d78580692dadb2978ddfcd44d68f8282bb3453c638c9a4c2feecc1b96f8
MD5 ede6388dfbb03ff576508b085d03e793
SHA1 71d2e779ac6ed074b5698651a8c7fa3b047ccb50
SHA512 097e3b9b2ad80944e542785db3a9062ecb2c657192d96659dcc5267f362b186c91722f2bc103f19ef895e6d9821cf33d262569fae23605888d75f38d2e30093b
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 189KB
SHA256 06d6fab9ab900207a8179ecd9adb2dc7fa859c05f607cd22231743b46193dd21
MD5 8dff410b428bb154731cb4a826be519f
SHA1 5f55a110b8716af4c7c8f50bc621240aa8b6286f
SHA512 ba96dcb9703b9c6dbd4b5697071bce23d9e29e967d6847be6de7935cd1d81e7683d771da4578156f097a18f193f0c33513082c0be1e0c01b29a81faf82a2a437
SSDEEP 1536:TPwN8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2Ajpf8oI4KEAUgq:Thuk8QsH47nW5ppkoI4KEAUgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 77d87b570d850e7c375bfed280042c2a5ef9882e49582c5ee9088f59c146cac4
MD5 93d833f731b0cd6e3c9354b732c2c11f
SHA1 6ada69d365ac41eff77ad8ad012dd6a550cbf6d3
SHA512 ec9fcdff1afeb53fbac0c286a4b46237326f79e5e1dc1c8d3bb8cade586694bbf09f5c31c7d0b615fc23f419dbd1a9ec20f6dedc56a376f58ce4a790b5274c52
MD5 SHA1 SHA512

Submit Download

memory/1832-14-0x0000000000870000-0x00000000008A1000-memory.dmp

Download

memory/1832-20-0x0000000000870000-0x00000000008A1000-memory.dmp

Download

memory/2972-0-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Download

memory/2972-17-0x0000000000FC0000-0x0000000000FF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads