urelas | 72928655c1cab6e499326902f7e27b7c74fe67a05469e0180aeedafce7251129

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe
Size 467KB
Sample240915-27rdlsxcpf
SHA256 72928655c1cab6e499326902f7e27b7c74fe67a05469e0180aeedafce7251129
MD5 e38e709c320cfc9b06fac6ac1f4ad75d
SHA1 76d14c98db11f68f98bf9212f633a35193c29582
SHA512 c5bba3056add22a33b48540f851e3777f00ec24e66a14be201d9a8a80dbba2525c60eeea689d9e68153b99a9fcdb2788fc142aa40133eea3e259693e08d91340
SSDEEP 12288:93CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mW:9x9GzHlTv/b35tecFB6b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4548	sander.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sander.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4548	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	83
PID 5056 wrote to memory of 4548	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	83
PID 5056 wrote to memory of 4548	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	83
PID 5056 wrote to memory of 1028	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1028	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1028	5056	e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e38e709c320cfc9b06fac6ac1f4ad75d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\sander.exe
  "C:\Users\Admin\AppData\Local\Temp\sander.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuyex.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat
Size 305B
SHA256 f3937022b01a8d7ea622a3075a32cb6ebb334f29a141f47161697c6a17acc7ce
MD5 21d8e8bc7dd1ef3f41f7612399152481
SHA1 47fe598746daff6356713610e1ce0d3c63f2996a
SHA512 af2c49c76114ea92bf8faa8d689f2e108aa76fe4f7b3fd0ce7db25470b78b54d00d27b015afad91875ac284542662cee75d98df60c1abcb4b01291a4780b34f0
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 66c8ae290d7cf992faf67b10d1ef8ad91857f3709f459af69b6a11f521a3aeea
MD5 145cec05d8d704ff7aa3d812b1aff628
SHA1 097ae09965ed3804359803708b8af87b5b90fcbb
SHA512 1037d7926aec2831c8b084cc19aa38ce91bc8dcff15af731ce0e7cea79fa7806d4d341a9535c39b0ccb8d6f19bc2badf6d20d3b4ab1c931cd5be6994c4323b9d
MD5 SHA1 SHA512

Submit Download

sander.exe

Path C:\Users\Admin\AppData\Local\Temp\sander.exe
Size 467KB
SHA256 3b0b49f22083691e6c19a559d7c2302a9e1e0b715e64f1d5ce93be165435be21
MD5 02983379017f8ccd3723c9eb5ee34815
SHA1 0183c5a39eee0135276104b2ad17a7119f7d4193
SHA512 ec67248a99a766f57d31aca7cefbc5e89e646ddba365efc42030ba8d1d5e56d0ae565018a766627d65b3ca49b9fff84da5ed33eefb558eab96fe91e4992e3fa2
SSDEEP 12288:93CtSokfFGUMKwlTIU/b37dJ75WEe+eKTxB6mh:9x9GzHlTv/b35tecFB6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4548-11-0x0000000000DA0000-0x0000000000E22000-memory.dmp

Download

memory/4548-13-0x0000000000DA0000-0x0000000000E22000-memory.dmp

Download

memory/4548-19-0x0000000000DA0000-0x0000000000E22000-memory.dmp

Download

memory/4548-20-0x0000000000DA0000-0x0000000000E22000-memory.dmp

Download

memory/5056-0-0x0000000000390000-0x0000000000412000-memory.dmp

Download

memory/5056-1-0x0000000000390000-0x0000000000412000-memory.dmp

Download

memory/5056-16-0x0000000000390000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads