urelas | 60f57dd2f1f5d4bb5248809628146a5fe2e555c02159064bd1b1fb39cacf7fa1

Analysis

max time kernel
95s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe
Size 3.3MB
Sample240929-2pfjdsxgrg
SHA256 60f57dd2f1f5d4bb5248809628146a5fe2e555c02159064bd1b1fb39cacf7fa1
MD5 ff6cb11caf4734d7bc426f0dc094e72c
SHA1 27186d53b1f7cd96d46351b6ccd924841a81cd0c
SHA512 2f3be959b4babc790145110883960dca2c08ecbde87d59ba7a4dffde08b7db2dfa03653e663dbccd39ecfa9d8e9ab46790e642b0bb4319a4affaf7e3df330a41
SSDEEP 24576:McbarwWkih3Qh3OXqZrKEHpG/nOYxMle1Wzl45DBk:zG0n46fZ6nOqMle1k4q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.209
112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3436	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3436	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	82
PID 4776 wrote to memory of 3436	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	82
PID 4776 wrote to memory of 3436	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	82
PID 4776 wrote to memory of 4060	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	83
PID 4776 wrote to memory of 4060	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	83
PID 4776 wrote to memory of 4060	4776	ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff6cb11caf4734d7bc426f0dc094e72c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d
MD5 02167b944a214fee3d34f9a7e356dc6a
SHA1 ca5b3f38a7151268726401593eb35f9b67bdde97
SHA512 c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 3.3MB
SHA256 feebcf6536db407c145cf92e1d6d91b08a437001afe1908b285092abfa390e85
MD5 f79a7dfe91f450ba4427e3fbc75efb51
SHA1 4fb4ede4413895ad43c739d834bbebc883cb270f
SHA512 bd211e8b0305ffd67460673fb57fd26bb3340f5d5e52e915dd4aa53d02f49b72b9d685aa2d317ed7100acedc3e6fb7c4be4d39e30fe9f10fa33b1e7f5a242570
SSDEEP 24576:McbarwWkih3Qh3OXqZrKEHpG/nOYxMle1Wzl45DBS:zG0n46fZ6nOqMle1k4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 029415b121cc5298d437e910d64e1e8d74c9ff6a80c6d28a95c37238449f7ef7
MD5 bb9fa0eaaa9e96dfa54925f29f3a3270
SHA1 da91d4bd0801e397eb134a2aad9dbe2578e0625f
SHA512 026b39692839ddf1ae4de759119718cff7044515f14d9d1aeeb94c6e4a7dacae10a20a733b5117dc8554a7b9bd7d644a177f21cc858b8de66cd4de09c95d11f7
MD5 SHA1 SHA512

Submit Download

memory/3436-16-0x0000000000400000-0x000000000077C000-memory.dmp

Download

memory/3436-22-0x0000000000400000-0x000000000077C000-memory.dmp

Download

memory/3436-31-0x0000000000400000-0x000000000077C000-memory.dmp

Download

memory/4776-0-0x0000000000400000-0x000000000077C000-memory.dmp

Download

memory/4776-18-0x0000000000400000-0x000000000077C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads