Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-10-2024 20:07

General

  • Target

    43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe

  • Size

    59KB

  • MD5

    43f70f6bb37593e40b4943e9e95edf48

  • SHA1

    37ad1fce32bca02c1eada6db421f945461dc409b

  • SHA256

    7fce64c5c5831ed61df104c4e787fdfc9772fd4dbe8ef1a0f60c679f5bcf16aa

  • SHA512

    134ffa376c1ec0f3a43e0e37a140592553ebdf5b4bf591ac331ce5d6a211604a7a533f349d7d6278420bd3646d20edb4c68ebb5a31e60d804ae517878d39e5ce

  • SSDEEP

    768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP5:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2944
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    55e10a9af74d3f3fa5ae3cb7ff5ad9d4

    SHA1

    449221fd8d7196a54de2bd583625d8d1b64db56a

    SHA256

    a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

    SHA512

    4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    302B

    MD5

    18da1fa6e662efbb03311968b810f706

    SHA1

    d36dbdd5ca383a2eb025959877dcc07a95079b06

    SHA256

    95f3230e7dfe567a4ba104380354e09d7e3ff493b14f44314389251082cb772d

    SHA512

    3de0c7d2be6eabdce239e306b5ee011fcddd6ca6f6db820a4e9ea7fa07cd81a777d4aa9082f55548e4938ea70ab43add8afbd3f6b1424977eacf294f6d74cef0

  • \Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    59KB

    MD5

    0473779af26f5598ed09ccb012dcbb43

    SHA1

    9c3387cc0a923f4a10a7335245d2d928f61972d6

    SHA256

    3b40a935e381b50395200a63a31c0ed3c7ebb68f65139a9119c082a67ba64936

    SHA512

    4d817fd9f3945fc766c7af8c988e3f0a936cdc8f88f626656e42f6c8b42ce42245c6fe8687e87e1bebe7c390886e38afa7520bc0e0c4e873dd82d1e23f32dbf9

  • memory/2084-0-0x0000000000E10000-0x0000000000E45000-memory.dmp

    Filesize

    212KB

  • memory/2084-7-0x0000000000410000-0x0000000000445000-memory.dmp

    Filesize

    212KB

  • memory/2084-18-0x0000000000E10000-0x0000000000E45000-memory.dmp

    Filesize

    212KB

  • memory/2944-10-0x0000000000CE0000-0x0000000000D15000-memory.dmp

    Filesize

    212KB

  • memory/2944-21-0x0000000000CE0000-0x0000000000D15000-memory.dmp

    Filesize

    212KB

  • memory/2944-23-0x0000000000CE0000-0x0000000000D15000-memory.dmp

    Filesize

    212KB

  • memory/2944-30-0x0000000000CE0000-0x0000000000D15000-memory.dmp

    Filesize

    212KB