urelas | 815e3457cf33bc0221afe4b3f8699e80d21712d4f24047d7bb7a746b3a917fa9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe
Size

264KB
MD5

10995dcf84f2070d6b49cb9ab4a88862
SHA1

efb9388c7cf4e47b1dbd1290af677b0f29ea8a0e
SHA256

815e3457cf33bc0221afe4b3f8699e80d21712d4f24047d7bb7a746b3a917fa9
SHA512

295e59ffd2fda39aa13b06f62a87f48d6766e9ce87b0abc91ffbc48beaa2e0c3d13c3b646cae3cc8eb1e71e4e90f347f29ecdddea5128069274be6e0c90f2143
SSDEEP

3072:AUApueDWSppTaeskDEjUrqfkZ557YzAL9gFoI3X3fZE5UANaE:ASeyGpTaesaQUufkL57YsL9NIx9ANaE

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2892	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1924	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1924	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	30
PID 1296 wrote to memory of 1924	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	30
PID 1296 wrote to memory of 1924	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	30
PID 1296 wrote to memory of 1924	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	30
PID 1296 wrote to memory of 2892	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2892	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2892	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2892	1296	10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10995dcf84f2070d6b49cb9ab4a88862_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
4514d58bb3af5fd2132870ab9e2897d9

SHA1
9bf67ec19026e2485416a37315a32a19972a69ff

SHA256
8bc8fa165190f94d0f84f4c5772a7aee9aafd778e395effcdf501055b0658fa8

SHA512
07941b5f5275a931b8b7be9c94062714a6f8546ff3df4479638b6638960f61d35ad25fefa3bd7fc9b0934e9814c40169dce5803aac5e25ae932b698c85688738

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
d42259690264b4a8ffd89ef3f7340fbc

SHA1
549e1019c064f325fc973048bee1dc7510d20e55

SHA256
31e2248f44f2510c56146dcccb9536321f459fef60d10113219c8ea405a88413

SHA512
4a894191194d9a11ea119f19b99c14f0e5d62b5c2dd3d8223bb10eac42d2b4b9f22d7ab5b73c986094c3c0193fa95b7be9951d7ff59c1e1a7f4e2ce68d8e148e

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
264KB

MD5
6ed920ddf96ba2e16e747087b52f44da

SHA1
5c0da9e38eca795d3cb2e7af8666037c08680a56

SHA256
ff6d6346e80601509889eefe088575d76ef8ce54b11da108893f0d35a6af6654

SHA512
dc928f7e220fa893fa2061c995b77f3107b15198e1a8e8def5fac833911a6852de5f702d158bb194d47fdbc931492c47721704e0209be7c4152c514bd35eb4b8

Download Submit
memory/1296-0-0x0000000001100000-0x0000000001151000-memory.dmp

Filesize
324KB

Download
memory/1296-6-0x0000000000520000-0x0000000000571000-memory.dmp

Filesize
324KB

Download
memory/1296-18-0x0000000001100000-0x0000000001151000-memory.dmp

Filesize
324KB

Download
memory/1924-11-0x00000000001B0000-0x0000000000201000-memory.dmp

Filesize
324KB

Download
memory/1924-21-0x00000000001B0000-0x0000000000201000-memory.dmp

Filesize
324KB

Download
memory/1924-22-0x00000000001B0000-0x0000000000201000-memory.dmp

Filesize
324KB

Download