Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 20:07

General

  • Target

    43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe

  • Size

    59KB

  • MD5

    43f70f6bb37593e40b4943e9e95edf48

  • SHA1

    37ad1fce32bca02c1eada6db421f945461dc409b

  • SHA256

    7fce64c5c5831ed61df104c4e787fdfc9772fd4dbe8ef1a0f60c679f5bcf16aa

  • SHA512

    134ffa376c1ec0f3a43e0e37a140592553ebdf5b4bf591ac331ce5d6a211604a7a533f349d7d6278420bd3646d20edb4c68ebb5a31e60d804ae517878d39e5ce

  • SSDEEP

    768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP5:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    59KB

    MD5

    885b73f7f66530b5d0fee7dc932cd0e0

    SHA1

    17d0e5d7c5e539223f49f8dd8548405a1defee7b

    SHA256

    c4215a3dd1645b1a417ad973d3e9fa0f5c43f8fdb8fdfa417406dfba6a3eb161

    SHA512

    4db24820370980212cefeb4102fad63b38866dde94401fc403e96077d17213c6565b1702fd2b6e707c6235c4d4c70983e3b8ec10868afabcbbfb6c2aecf0e67b

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    55e10a9af74d3f3fa5ae3cb7ff5ad9d4

    SHA1

    449221fd8d7196a54de2bd583625d8d1b64db56a

    SHA256

    a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

    SHA512

    4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    302B

    MD5

    18da1fa6e662efbb03311968b810f706

    SHA1

    d36dbdd5ca383a2eb025959877dcc07a95079b06

    SHA256

    95f3230e7dfe567a4ba104380354e09d7e3ff493b14f44314389251082cb772d

    SHA512

    3de0c7d2be6eabdce239e306b5ee011fcddd6ca6f6db820a4e9ea7fa07cd81a777d4aa9082f55548e4938ea70ab43add8afbd3f6b1424977eacf294f6d74cef0

  • memory/2080-0-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2080-15-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2980-10-0x00000000009A0000-0x00000000009D5000-memory.dmp

    Filesize

    212KB

  • memory/2980-18-0x00000000009A0000-0x00000000009D5000-memory.dmp

    Filesize

    212KB

  • memory/2980-20-0x00000000009A0000-0x00000000009D5000-memory.dmp

    Filesize

    212KB

  • memory/2980-26-0x00000000009A0000-0x00000000009D5000-memory.dmp

    Filesize

    212KB