Analysis

  • max time kernel
    150s
  • max time network
    81s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2024 20:08

General

  • Target

    41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe

  • Size

    446KB

  • MD5

    41d6464ffa1ec0d15308465a8187eea2

  • SHA1

    9e84fd1c73f389be7f2f86bc3c76808b2d5f5ffb

  • SHA256

    aadaa8a794e656859ccb247ae5dc46a66920225db288f53237d8f3b2818db76a

  • SHA512

    9c09a2b7f128d179807975daa83b3c791fbb8762222fb8d29f0bac5dfc189f5f207ca0485680533f26ee3efd3668b3775486ff0a3d6cc436855222129621792f

  • SSDEEP

    6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomn:PMpASIcWYx2U6hAJQn4

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\gidij.exe
      "C:\Users\Admin\AppData\Local\Temp\gidij.exe" hi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Local\Temp\opvyci.exe
        "C:\Users\Admin\AppData\Local\Temp\opvyci.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Users\Admin\AppData\Local\Temp\cywul.exe
          "C:\Users\Admin\AppData\Local\Temp\cywul.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2700
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2836
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    ef2b73166547b3fe2fef0e29b39daa45

    SHA1

    b08caa3a47057cd651723bfe72b77a936a7cce76

    SHA256

    ab80161a544631984b272ae21f52017e036866ec599eb85d295ed54eea8798d6

    SHA512

    cfa240597d2c6e3f11cab625b8b70b7eac6502764e19fa82995ada1b9631a9e64026369c73943fe08cebd16d096f6271bd03b55609b4e1b661aaf725b36292ca

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    4d64dc876ce23798882f1552c0d892d5

    SHA1

    e46cdf174e708f6fc95412f613c720f007861128

    SHA256

    33a6c604042fe7b2539e18c0b94c0dd5f85bc4260c69cbc274807efbc7786863

    SHA512

    db4175826c42b7f5031b81586d1b085402cd8ddc76945e35a9256926f3efbabceaccdf16b9c6d90897ce833ab19756934a3f26507d355ce6c9124950f19234ac

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    b79034f85d28b26913139a6bfef20d53

    SHA1

    72cf006e53854d0fe107fa70b0a69f8f799c2709

    SHA256

    545185129fd6e7c6cded59fd821b9d37829f2fe0a80a73152fe2dbf6fceccbe3

    SHA512

    be83ec704277faaefcb13b5265276601f7fa7781d4d0ad0a8adfff9d65a358eeb0736565afdfd48b87781994054aebbd4fbd396ad335d5e8b1a68e29c0dc7a9a

  • C:\Users\Admin\AppData\Local\Temp\opvyci.exe

    Filesize

    447KB

    MD5

    37ee9df03c2c4b70fa8c849696d0e766

    SHA1

    91ad3a8db6327d88b1923076e00153f8cb80c8b2

    SHA256

    4babf12cac8700a1215d0769b571cc6dafe89d504e80581d47535e34065853d6

    SHA512

    e9ae62c3c7b7ac6ce3911c3103315518a5bd8147ed18bc5f2b76bc72ddae978bed0491bfe2b39496fa44abc90826127bd40c37570acb09be026bad3459f584c4

  • \Users\Admin\AppData\Local\Temp\cywul.exe

    Filesize

    223KB

    MD5

    071f5b27eec863360612ff7cd7125af9

    SHA1

    d1603ab9cc0bab3e8b1e1f763bf117dc5a90816e

    SHA256

    b5d03935d6b66e532ed28953908c061af8aec503546ed368fd363a82a7a07758

    SHA512

    215e8452b2c38eca7d7dd854b58ff77da9d1637523f56e473d428a53f7ebd34cf24e92b40ad1b9e5ccec2f78a1553a3409c2790f50f8e13b0925c3071f1ead9c

  • \Users\Admin\AppData\Local\Temp\gidij.exe

    Filesize

    447KB

    MD5

    5a403cd23db801757e12b6ee21cd4e89

    SHA1

    be3bbbd74fa4686a6c83461af37f5342730299dd

    SHA256

    318c2097cfe0efa17dda1105b28777628bab4b48d345cdde1d58d3ffd65c4ecb

    SHA512

    c48046b3db36d493c1d76af87ca2a34ba85927c684f1ab9291691fe45ec384e9cecb06f82b4a8b9fbde1dcc3cadcbeea6055900d4c07f1123a67666eb9dd6b82

  • memory/2248-20-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2248-9-0x0000000002470000-0x00000000024DE000-memory.dmp

    Filesize

    440KB

  • memory/2248-0-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2700-50-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2700-54-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2700-53-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2700-46-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2700-52-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2700-51-0x0000000000F70000-0x0000000001010000-memory.dmp

    Filesize

    640KB

  • memory/2876-26-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/3012-44-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/3012-45-0x0000000003280000-0x0000000003320000-memory.dmp

    Filesize

    640KB

  • memory/3012-29-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/3012-27-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB