Analysis

  • max time kernel
    148s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 18:07

General

  • Target

    4150869444302f78451b1d4834933554_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    4150869444302f78451b1d4834933554

  • SHA1

    7767ed14ff5aa6d9554665ac52994bdfb90b6dd9

  • SHA256

    ff7d56c1a7efc795cbd031c054dedfe8fa354a370b212a8a8e10be62d263cad0

  • SHA512

    4a4dba2b633b6902bfd07a56679c2d97123b56431aecbd97edfb8b49c42f2789e05a04aaeb9abf03381ff1349f08ac456bfb82276065fe4fdc6c9f152694b437

  • SSDEEP

    12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5YN:tcykpY5852j6aJGl5cqBA

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4150869444302f78451b1d4834933554_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Users\Admin\AppData\Local\Temp\gyyxz.exe
      "C:\Users\Admin\AppData\Local\Temp\gyyxz.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Users\Admin\AppData\Local\Temp\xupeci.exe
        "C:\Users\Admin\AppData\Local\Temp\xupeci.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4524
        • C:\Users\Admin\AppData\Local\Temp\ibsum.exe
          "C:\Users\Admin\AppData\Local\Temp\ibsum.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4996
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    a4e89c7ca30b163217150fd27585d12f

    SHA1

    0efd30bf1bd473ca2ac1ece031306bf54728d0b1

    SHA256

    bb5bf02f351c90535f61a12a9718cd59dfae8c11485d9410a328fd3ab729b3b3

    SHA512

    9a41cdb2c7c68216f9a69bdeae187724bb9928e1485e2b2d07426f1d659860f6dc27e1d81483d89c739d4a445be913cb108e85d0ef046318c18a5bd2e7ebfe32

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    c305e2764c099cae14b0d3cff83f73c0

    SHA1

    cc6b54280b2048160b8345c35419a6072056461d

    SHA256

    cf8fc8f48cf0a4546ac3e391795184c9eae7810581d1319341a60aa806b18515

    SHA512

    316acb4ca497a55715f32a416291586fcc63d38ae8560be135d71719a7d116443f2789dd5f7fc16cff35b47507f75e0131e5722ae70f97bc28d167d1322ef3c2

  • C:\Users\Admin\AppData\Local\Temp\gbp.ini

    Filesize

    104B

    MD5

    dbef593bccc2049f860f718cd6fec321

    SHA1

    e7e9f8235b4eb70aa99dd2c38009f2152575a8d0

    SHA256

    30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a

    SHA512

    3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    108d0b0fd052c85992c8db84515a268b

    SHA1

    29992ff6d7847766f3063c6ad7802fb15d140a16

    SHA256

    6f7226d240878b4fdf7a6d9e51f31ca7f987b59e6b4f38c5af498ff04688be24

    SHA512

    045c2cfad54c478b5181bc3d73c45a3de25291520f5627c6563b7fdc4e01e47bca2af18cc5af7760a557b5a584c7557a8f94d0d960a7745367596fd8800c88ef

  • C:\Users\Admin\AppData\Local\Temp\gyyxz.exe

    Filesize

    1.1MB

    MD5

    c12384fbc2d08af0d4e8ee73a0621b13

    SHA1

    dedc1067566a21abae738c07542f4f2816dd4774

    SHA256

    1c9523e52b475f24cc004cc80cc9a966693db25ec0ec339dcc77a0f577defd60

    SHA512

    d4a48828dde2db846cc04ece6a785db6d1d2903743cda228af34a322b14f1fbaec9000c5f26172f53482049d32c6779dd9aef7e4384bdf0de292a4c67fb4bd6c

  • C:\Users\Admin\AppData\Local\Temp\ibsum.exe

    Filesize

    459KB

    MD5

    3b35dc0c69c595b1bba6a6aca3da22d9

    SHA1

    977b8bdd0ff8d2bdd3aeca235005917170df9b0e

    SHA256

    e5ad9dba9d9d9a9334f6e3bc7d3c8cc3f1fe0a5c954e4dc9e15db707d3198e2e

    SHA512

    161056d401d79d97538da5abe0be3fc6887ecfe08de48dc2a755d46bb67743da58866b270ed5de8f5b44d1e9b70387f3d87efe2a509f21bd18fd14ce2bd6d871

  • memory/1796-26-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/1796-14-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4524-25-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4524-27-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4524-41-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4576-0-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4576-16-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4996-40-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB

  • memory/4996-44-0x0000000000400000-0x0000000000599000-memory.dmp

    Filesize

    1.6MB