Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2024 18:07

General

  • Target

    4150869444302f78451b1d4834933554_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    4150869444302f78451b1d4834933554

  • SHA1

    7767ed14ff5aa6d9554665ac52994bdfb90b6dd9

  • SHA256

    ff7d56c1a7efc795cbd031c054dedfe8fa354a370b212a8a8e10be62d263cad0

  • SHA512

    4a4dba2b633b6902bfd07a56679c2d97123b56431aecbd97edfb8b49c42f2789e05a04aaeb9abf03381ff1349f08ac456bfb82276065fe4fdc6c9f152694b437

  • SSDEEP

    12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5YN:tcykpY5852j6aJGl5cqBA

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\rekaw.exe
      "C:\Users\Admin\AppData\Local\Temp\rekaw.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Local\Temp\koivwe.exe
        "C:\Users\Admin\AppData\Local\Temp\koivwe.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Users\Admin\AppData\Local\Temp\kuuqw.exe
          "C:\Users\Admin\AppData\Local\Temp\kuuqw.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1652
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1672
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    a4e89c7ca30b163217150fd27585d12f

    SHA1

    0efd30bf1bd473ca2ac1ece031306bf54728d0b1

    SHA256

    bb5bf02f351c90535f61a12a9718cd59dfae8c11485d9410a328fd3ab729b3b3

    SHA512

    9a41cdb2c7c68216f9a69bdeae187724bb9928e1485e2b2d07426f1d659860f6dc27e1d81483d89c739d4a445be913cb108e85d0ef046318c18a5bd2e7ebfe32

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    0cfe2b017f6a530f04ae3f74fb3c429a

    SHA1

    374a41d042447ba25a06a3decf53bd0454963ffb

    SHA256

    4dba2bae815fc65db6610d7d9fb796a211bdac73c8fe8db31075dff9ac1d1c2f

    SHA512

    e1140030234d29556c910a006b7b0f2d0dfe9c33330bff540072385b24a156f2c576faa75959180ac8362ab151366a9b82d7dcda1edfccccd788b01151c0e7ef

  • C:\Users\Admin\AppData\Local\Temp\gbp.ini

    Filesize

    104B

    MD5

    dbef593bccc2049f860f718cd6fec321

    SHA1

    e7e9f8235b4eb70aa99dd2c38009f2152575a8d0

    SHA256

    30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a

    SHA512

    3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    1a44e0d4f17e29cb7d213a0a43d15f3e

    SHA1

    bba4b2a633af41ec7ea0643f2aa09dbb73631151

    SHA256

    a5728470a4ed54c07a6ef4bee520648e476bd6fbec1b8d8543faa656500f6a38

    SHA512

    1db4d6c8f717c317345a69b60f4d83ef9e5174395a5f111b330202359ec72a374b2933a586b2c7f6eaac4193c384e4217eefa06a1822a3dc22995dcf5d61e907

  • \Users\Admin\AppData\Local\Temp\kuuqw.exe

    Filesize

    459KB

    MD5

    0f731b0e7e77acca231c09be1e0be30e

    SHA1

    4e30841a53edfec28ed84c49bed920274dcccb97

    SHA256

    5d391c68421a63cd893fe81a344972e48e7c8871d8c752906aa0c63851cc2307

    SHA512

    ad268840afed98f26fe50c9a0fee666c7a5c5199d884964596d01b3776264da8b2523c29e41b1c1e3e8d271ec125510543405fd0f8f86e65eb8b6c5c9c09d659

  • \Users\Admin\AppData\Local\Temp\rekaw.exe

    Filesize

    1.1MB

    MD5

    4e7ae3a01d58adf1197e106fe3660c55

    SHA1

    79e35eeacee004e71db0a275fcc87907e48853c3

    SHA256

    fe822bb513b5af18fc69582a300e9a2765af5a7ec9b585b74f5d88d87005caa2

    SHA512

    5facfc8d5438156f7ad5259edcdc16c4150b2e79d232787e75dc56f5aef8d28928a91914dc91788941caeb1b941c92f35f06a462d1bfa370972a2483e8bc2d4a

  • memory/1652-59-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB

  • memory/1652-54-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB

  • memory/1888-23-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/1888-34-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/2964-52-0x0000000003A10000-0x0000000003BA9000-memory.dmp

    Filesize

    1.6MB

  • memory/2964-37-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/2964-36-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/2964-55-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-2-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-19-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-17-0x0000000002680000-0x00000000027A4000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-20-0x0000000002680000-0x00000000027A4000-memory.dmp

    Filesize

    1.1MB