urelas | 526f35f43b534370f6a3d732a110e3457e7ac878e24d22c639680318a290e3ad

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe
Size 412KB
Sample241004-faesnavdlp
SHA256 526f35f43b534370f6a3d732a110e3457e7ac878e24d22c639680318a290e3ad
MD5 11de899e7f3337f0432a1f1dc4024e04
SHA1 82a1e49023665d5a49e4a7f667d90d8ec4682df7
SHA512 80adf82d7dd4934796fde03e6edd32c9fc735d563da2eccdee26cef07f6b0ae0202c642917b2bcb9db1ee47dea79287e465f640ee057e5fb7e6d68101f85e425
SSDEEP 6144:tzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODonZk3:hU7M5ijWh0XOW4sEfeOX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas aspackv2 discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00050000000004e7-21.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	wixox.exe

Executes dropped EXE 2 IoCs

pid	Process
4088	wixox.exe
1512	payrr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	payrr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe
1512	payrr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4088	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	89
PID 1328 wrote to memory of 4088	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	89
PID 1328 wrote to memory of 4088	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	89
PID 1328 wrote to memory of 3284	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	90
PID 1328 wrote to memory of 3284	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	90
PID 1328 wrote to memory of 3284	1328	11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe	90
PID 4088 wrote to memory of 1512	4088	wixox.exe	102
PID 4088 wrote to memory of 1512	4088	wixox.exe	102
PID 4088 wrote to memory of 1512	4088	wixox.exe	102

C:\Users\Admin\AppData\Local\Temp\11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11de899e7f3337f0432a1f1dc4024e04_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\wixox.exe
  "C:\Users\Admin\AppData\Local\Temp\wixox.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\payrr.exe
    "C:\Users\Admin\AppData\Local\Temp\payrr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3000,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 304B
SHA256 fc40bbde85f76c581c8674206dda7a1c79697d26e5893a2e00d05861190c083c
MD5 57a4c5375887b48eff9a1b0cdc417046
SHA1 153bb725763bee3c3f6e256efb7c750ecfd6910b
SHA512 f061f9fa00520aed3e4322170b46428591ea38537fbd33e9a8a97618d4cd18132748df53e006f1a6606c6363966a9bcd27db9e42fe4a773edc89a82eeaae8fcf
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c9cbfdd5aa52aaea05f6a1757dd672d6adad04b1aa9ac22e584de20a880afe51
MD5 668ea44aa909300f7ec491780285772a
SHA1 bf95d499a9e898715c7ac0a3c2b92bc08efe5eb6
SHA512 986938a81163f084b4f275423466a1760c0ca4bc57bd15d48ae3452c595f77a7b817d70f68d387ceb848aca072d68968b8424382f3786c8c1df6272b8c540a21
MD5 SHA1 SHA512

Submit Download

payrr.exe

Path C:\Users\Admin\AppData\Local\Temp\payrr.exe
Size 212KB
SHA256 5fe4363bf8b00c292d70cf103b971c3b7ce785c1dc15e31e221ef6c9fdd81b69
MD5 9e0f861cb559ec41b2dceabb908ca553
SHA1 b4baee61df510b63ec0a53fb94a6f436e1b4986a
SHA512 62a020b4f19acfb638d8cb8d5c0d29129de791b321f8350adc31d33d8028521fd0952b21f6f628cc992f37e7e8a2a39405e0faba07e9b7b1736d76d75011e548
SSDEEP 3072:AyM5pMZ3TRUMf8cXyGeK5+SQv15VQIN3C9ISE0qJiNlUtpEICT:rM5piVVZPeVQISzqJRpA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wixox.exe

Path C:\Users\Admin\AppData\Local\Temp\wixox.exe
Size 412KB
SHA256 8eececdf6c98ec91ba7d9e9492d57a3c6002c1fa6ec9d776658590f2db72bbaa
MD5 156c02dbdf8db4f48b9c42bea49a1a34
SHA1 1e44e727c0a9716d3908208ba089911cd4f7a408
SHA512 c561afaddf2a2c86009ce1945638bd2790472bcf9554c7bb959977d9c8a421d08249946ac399eacc7ad4880a11b2a664e661c7ecaa45657d5d2eef69915f0832
SSDEEP 6144:tzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInODonZku:hU7M5ijWh0XOW4sEfeOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1328-13-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/1328-0-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/1512-31-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-24-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-29-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-28-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-27-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-32-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-33-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-34-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/1512-35-0x0000000000F00000-0x0000000000F94000-memory.dmp

Download

memory/4088-26-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4088-16-0x0000000000400000-0x0000000000465000-memory.dmp

Download