urelas | a24c0426d17c33cbc4a2eafe5dfb4bd2acb6c0453e977d103f628dbd87250489

Analysis

max time kernel
148s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe
Size 693KB
Sample241009-ax2caaybpf
SHA256 a24c0426d17c33cbc4a2eafe5dfb4bd2acb6c0453e977d103f628dbd87250489
MD5 27d524b5c4969858886b8652c2fc9e1d
SHA1 2b65cb21cc8945ac9be7d3eb69333ba5602dce60
SHA512 ce8d41f6fb9cf140c9eb0395f44448feea003474802b102a1e6bbdfd8f9ab64978ce557cf22c88a24cdb9f2ffc92ec8d275684829223ebaf668381d747a2cea8
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nrv:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnrv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ipdovy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	kurel.exe

Executes dropped EXE 3 IoCs

pid	Process
4972	kurel.exe
3668	ipdovy.exe
364	tisyc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kurel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipdovy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tisyc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe
364	tisyc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 4972	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	85
PID 1376 wrote to memory of 4972	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	85
PID 1376 wrote to memory of 4972	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	85
PID 1376 wrote to memory of 3948	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	86
PID 1376 wrote to memory of 3948	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	86
PID 1376 wrote to memory of 3948	1376	27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe	86
PID 4972 wrote to memory of 3668	4972	kurel.exe	88
PID 4972 wrote to memory of 3668	4972	kurel.exe	88
PID 4972 wrote to memory of 3668	4972	kurel.exe	88
PID 3668 wrote to memory of 364	3668	ipdovy.exe	93
PID 3668 wrote to memory of 364	3668	ipdovy.exe	93
PID 3668 wrote to memory of 364	3668	ipdovy.exe	93
PID 3668 wrote to memory of 1220	3668	ipdovy.exe	94
PID 3668 wrote to memory of 1220	3668	ipdovy.exe	94
PID 3668 wrote to memory of 1220	3668	ipdovy.exe	94

C:\Users\Admin\AppData\Local\Temp\27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27d524b5c4969858886b8652c2fc9e1d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\kurel.exe
  "C:\Users\Admin\AppData\Local\Temp\kurel.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Users\Admin\AppData\Local\Temp\ipdovy.exe
    "C:\Users\Admin\AppData\Local\Temp\ipdovy.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\tisyc.exe
      "C:\Users\Admin\AppData\Local\Temp\tisyc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 304B
SHA256 27257fb061139304b960568eb5d65e208e7aafe8e287b4af352d38366cd27ff4
MD5 d6fcdce42ff49e264a9ed290dceb6ae7
SHA1 55bd849351d5a4f544cef518e3af7891add797ac
SHA512 3059cbed127232f4609d4484ece1015224bdf025e3cb1a3cbefed6489dc993fec49174b0114f51e4940073cf1ea493794e5fb3e89e29a794c92b247087c63365
MD5 SHA1 SHA512

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 27fa74e30baba968c8d2113726e8f8670039153dfbdfc4bb928899e4658d64c7
MD5 dd7e8ce8e7a65a4ba78af8ce8fc22782
SHA1 281e99c13a27424bad3fc61ac7ce7fc1681d6643
SHA512 3cc3c440d530f224d706911ee883768685f1f1c281ba1190abf291b4768f72e0cbd73bb6da35bea0e382d3fb6e13fa12af7a7779e8fd281f79d72e5b3db0a071
MD5 SHA1 SHA512

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e4150d6b2d4fafab76bc1e03b45b155b4a072682ac18cd45d44c342956cceed1
MD5 b269d51f1bc6065b1076cf3d73b01a42
SHA1 3e497a6c6b209b9deb9e6e33c029989e23261ca1
SHA512 27e82a89e11502ea9267a16d29c2ed031c11aa7117b849268dba3f76a3c933f936e29056401982f94dfe554a7f08b0cf67d7dfda58499382dd19c0e72a716910
MD5 SHA1 SHA512

Submit Download

kurel.exe

Path C:\Users\Admin\AppData\Local\Temp\kurel.exe
Size 693KB
SHA256 7b6d44e12d3f3a665e101d4c1cbcf60eb006c6542085969df4a7d2d1e6fa3307
MD5 65a841005a178786c31e2902a2c00e10
SHA1 7cdb41683c205dc991ab12987b5387200c3858de
SHA512 a7b3b677ee2207b57ee2e404de5321ce1218c7f8f8c95a921444072b75fc927180db71f3dff6fb2cb7ba7201074447f01edd2f8b39a3a742b81a6ce70989c5f2
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nr+:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tisyc.exe

Path C:\Users\Admin\AppData\Local\Temp\tisyc.exe
Size 469KB
SHA256 204a9cf1d005465b27c39de086699966a744a02b644062b106910733ce060d67
MD5 80cd39c7c20c59d7dd205ec6a3bb401f
SHA1 081d8b02fc7f0e08d8c87a3a2bda10939f0809b4
SHA512 6e2e658f7df3286fbaf9921a83e7066baaed851e3e28e2c266b20a7a64d62edb4b190321345a157c1c08f90030d7ff77581bccd4a2fd5c0597508f624dc38fb4
SSDEEP 12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+7R:RIbq0ft8gLvoko1hmkQ5cXzyvL/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-42-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/364-37-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1376-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/1376-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3668-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3668-39-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4972-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Download