Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 20:08

General

  • Target

    41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe

  • Size

    446KB

  • MD5

    41d6464ffa1ec0d15308465a8187eea2

  • SHA1

    9e84fd1c73f389be7f2f86bc3c76808b2d5f5ffb

  • SHA256

    aadaa8a794e656859ccb247ae5dc46a66920225db288f53237d8f3b2818db76a

  • SHA512

    9c09a2b7f128d179807975daa83b3c791fbb8762222fb8d29f0bac5dfc189f5f207ca0485680533f26ee3efd3668b3775486ff0a3d6cc436855222129621792f

  • SSDEEP

    6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpomn:PMpASIcWYx2U6hAJQn4

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41d6464ffa1ec0d15308465a8187eea2_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\vehau.exe
      "C:\Users\Admin\AppData\Local\Temp\vehau.exe" hi
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Users\Admin\AppData\Local\Temp\funewo.exe
        "C:\Users\Admin\AppData\Local\Temp\funewo.exe" OK
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Users\Admin\AppData\Local\Temp\seumq.exe
          "C:\Users\Admin\AppData\Local\Temp\seumq.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3300
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    ef2b73166547b3fe2fef0e29b39daa45

    SHA1

    b08caa3a47057cd651723bfe72b77a936a7cce76

    SHA256

    ab80161a544631984b272ae21f52017e036866ec599eb85d295ed54eea8798d6

    SHA512

    cfa240597d2c6e3f11cab625b8b70b7eac6502764e19fa82995ada1b9631a9e64026369c73943fe08cebd16d096f6271bd03b55609b4e1b661aaf725b36292ca

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    c712a9cf99dce76c14302cffe2df2af8

    SHA1

    2f8b0a922144dfeeb57699c83572a2c905312231

    SHA256

    fedc35d98d5156a129e629f79644d2bddda7b2ac678f979b76fd42b1207d8d41

    SHA512

    8fca0d66c06a28a4a240799642130c74b4da8a958cd3edadeacbea03a3d501edce977cb0c3785f2237f867caa2a4bfd0bf578931e87bd3814aca4cfb3a49be17

  • C:\Users\Admin\AppData\Local\Temp\funewo.exe

    Filesize

    447KB

    MD5

    6255360ba18ce7ac9c8491ba04bb50b3

    SHA1

    65cbd531c7ec3605ecead27db7a9ef4715267916

    SHA256

    99e84e2275775e89dd93ecaa105c8c40b3789e8c806966fcb79755944a3f3ba2

    SHA512

    999ccf4ee76f51c9b52030d34e62a34ad679eda648fb2361a5a1bf28937bd47039308a6170a2651d07a69747e00c500324c7b64b7156a356f1f6ebaf89bd7606

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    cdf6792a15de4018eb0a5d57d5441877

    SHA1

    a8544b3869df1389fbf14d688bc5229cb7cfdc71

    SHA256

    1f01d1787227020114773cea640a287f82836f159931f61bfbdc68bfe9ceaa18

    SHA512

    921173f95d427afcffe33a4e7df58beb6ad9dc16f84957add4d5126d234ad6769d8601f24acf7b3625ebfbafa23c3adb330a26ee12ca074c6110e530f2cc9c62

  • C:\Users\Admin\AppData\Local\Temp\seumq.exe

    Filesize

    223KB

    MD5

    c6de1ed20163655825a4294c923f0244

    SHA1

    3d47ac1f440a7bf5e86614f0e3ade5aeacca2b42

    SHA256

    b63e405794c2098751362e7b57a2b62ba11d68b6af739c45e44c927d1e081ff0

    SHA512

    53c19b24d0f1a39874101c7aab0da41abdc9b0cbbd575377bb33006c6f917587feeb46358a9d59df431b507f0018633fd32df281aa33f305c07ba05e7e5cf0d6

  • C:\Users\Admin\AppData\Local\Temp\vehau.exe

    Filesize

    447KB

    MD5

    e5d20c07e3ea1c02d178ca6c69215484

    SHA1

    4317a5c87046171597a9a5b55fb453d83b8df2f6

    SHA256

    0da9e0b72e79ca28da94598f506878a2d125a9c04f8ed1700f802d95cad1d885

    SHA512

    383c3b4802f764936d3f08d0fe9cca8c60d1fa24084d458db6806a6c81f1c92530714623dd3a282d2e65e673dbf8887cf9c30d4d77e3128438045df82712ea4e

  • memory/976-14-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/976-24-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1956-26-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/1956-40-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2316-37-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/2316-42-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/2316-43-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/2316-44-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/2316-45-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/2316-46-0x00000000008F0000-0x0000000000990000-memory.dmp

    Filesize

    640KB

  • memory/4764-0-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/4764-16-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB