urelas | 76fdaf526b215d3177fb35cbd9173bd44053567c48773a7760fdcab6d1bb306f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe
Size 208KB
Sample241009-cmkynasflm
SHA256 76fdaf526b215d3177fb35cbd9173bd44053567c48773a7760fdcab6d1bb306f
MD5 28f75940f411b99ddc8effc0d621f299
SHA1 62250136739699721af8368b239f212bb454edcb
SHA512 4ae2e1831f59aa8ba0ea4c822b57229d19593332ba5b5c39ceb3e001deb05d5dbe207bce94baea7f4f86d1230558fa96a6b924a93abe607f6696bf587b5ebe38
SSDEEP 1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcRs:PuchogM57bIL+eb61TVa+3MJb63
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.209
112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2328	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2328	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	86
PID 3680 wrote to memory of 2328	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	86
PID 3680 wrote to memory of 2328	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	86
PID 3680 wrote to memory of 2288	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	87
PID 3680 wrote to memory of 2288	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	87
PID 3680 wrote to memory of 2288	3680	28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28f75940f411b99ddc8effc0d621f299_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d
MD5 02167b944a214fee3d34f9a7e356dc6a
SHA1 ca5b3f38a7151268726401593eb35f9b67bdde97
SHA512 c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817
MD5 SHA1 SHA512

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 208KB
SHA256 1949a0cd1a1b512ef9854a6ff20bd0f0973c52541eb4149cb97c04830541822b
MD5 0a6556ec255cec257507499745183dda
SHA1 e6caa0d056fbb619537e68d29f9d78e2252e866a
SHA512 76a932fe9f68ec091b6204b6a75fd8f6f243bba56d90f4f031a9e3fe94bcf9a327bc676e39016919117936ed4f67c88070bf85153d27dfadf2ef074dd7e9ee72
SSDEEP 1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcRv:PuchogM57bIL+eb61TVa+3MJb6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 302B
SHA256 76de2239ed945de2c3acac685872e43e5cd080b9307f73e6f5055d947ccefa4f
MD5 c9c803450c17d01b3d049ea54ca6798d
SHA1 4d37036d8aae7eb18ce09ca6d6ca50fae41d451c
SHA512 7f8d501217a1d8b5788ed46aa5144ed87778046bcc74b900b5249f60dc1b07becd55a7621e58eb8b7876c808bd113de20ea4b0546cd153b09892cd35433f7f3b
MD5 SHA1 SHA512

Submit Download

memory/2328-19-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/2328-20-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3680-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3680-16-0x0000000000400000-0x0000000000437000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads