urelas | e8c00cc03db3019b0661af783fafcc2097adb9f016bf53841499292a07c50362

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/10/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe
Size 494KB
Sample241016-ej6r3awanj
SHA256 e8c00cc03db3019b0661af783fafcc2097adb9f016bf53841499292a07c50362
MD5 4b4f5e9a2cad10984ee012634bbb2d3f
SHA1 d9810a7a26f8f1a1501b19b610f9342da9e5ec69
SHA512 6e9e6fb5b53319928a513bbbfd20fca8588c41ce0f0953571c15e654cd8269d5d7d593af5a3f15493be4671ac41d26da485d53166b8e9b6c42f6bce0580502ce
SSDEEP 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwZ:AOgwmisETzuaeDPvjJ81VGqK6GvPQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2548	cahin.exe
584	wiolq.exe

Loads dropped DLL 2 IoCs

pid	Process
1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe
2548	cahin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cahin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiolq.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe
584	wiolq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2548	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	29
PID 1564 wrote to memory of 2548	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	29
PID 1564 wrote to memory of 2548	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	29
PID 1564 wrote to memory of 2548	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	29
PID 1564 wrote to memory of 2544	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	30
PID 1564 wrote to memory of 2544	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	30
PID 1564 wrote to memory of 2544	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	30
PID 1564 wrote to memory of 2544	1564	4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe	30
PID 2548 wrote to memory of 584	2548	cahin.exe	32
PID 2548 wrote to memory of 584	2548	cahin.exe	32
PID 2548 wrote to memory of 584	2548	cahin.exe	32
PID 2548 wrote to memory of 584	2548	cahin.exe	32

C:\Users\Admin\AppData\Local\Temp\4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b4f5e9a2cad10984ee012634bbb2d3f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\cahin.exe
  "C:\Users\Admin\AppData\Local\Temp\cahin.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\wiolq.exe
    "C:\Users\Admin\AppData\Local\Temp\wiolq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 304B
SHA256 cd4482de633b84dc7a35b9fe01b4670abc54fb8d31189e8c3feda619187f2682
MD5 c5e43160c1d7801adbdb6d0eb56e0bda
SHA1 964ff57f91f37ea11ed6caedb6dccee877bb16dd
SHA512 6e70f29f290b71e5b78dd08380ef87905cb0f81d3ebd09974d9af3980cb05735470e4997e138f2032234dac77787fde5fdf53552d90405cc62933581fe732f51
MD5 SHA1 SHA512

Submit Download

cahin.exe

Path C:\Users\Admin\AppData\Local\Temp\cahin.exe
Size 494KB
SHA256 a1f02f4bad0948b9952f2f58e3175464c5a383fe6b4dfaad5c75417f708702bc
MD5 6bb237bf2064014cc60fbeb31696793e
SHA1 2bdb0755a8bf23718c8734d48139857df966b8cd
SHA512 ad4588209291a7802fa31b5ac56efb268ced4429fce94383238b86e4f1b5797270f8ae4127779cbcc08b8b92b60be90342c7f6d65071bbefaa863f313e094ab9
SSDEEP 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwE:AOgwmisETzuaeDPvjJ81VGqK6GvPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

cahin.exe

Path C:\Users\Admin\AppData\Local\Temp\cahin.exe
Size 494KB
SHA256 19641c9ee0abc34fabf62b5b320692349e705119586c9e89d6ff545bd824382c
MD5 febf20bc92758885d2a5eefcc0a7c13b
SHA1 5b937d3570a17be427c57e7fd75f1d479d490157
SHA512 53188672db1dd7d7689d8de3fe940baac7b0e316f2733b92aca08a2c4d51b73ab0411913851cbfa6ca63f635e9a6f725cf465a204a772660cb345ac9036ce56a
SSDEEP 6144:NKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwA:AOgwmisETzuaeDPvjJ81VGqK6GvPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 dffd712cfa29aa7361aeb5fada314ddf982489f19a8a4a62a4a2e46a41944ba5
MD5 23417214b02843d8fa8a7103695dffc9
SHA1 b8791f0057a8c7ed63855aa3846a49cb3d7d23c9
SHA512 92c7a5351b202aa316bddb4f95fa4e2ca04faba018e9637692fe5e7bfecafc5a17d7cab91fda699035ecaf34a40b4af979bf4e1035aa3ac2675bb95b780341eb
MD5 SHA1 SHA512

Submit Download

wiolq.exe

Path \Users\Admin\AppData\Local\Temp\wiolq.exe
Size 179KB
SHA256 0d666bb360b215155963ec792a8e36a373208756766367d6a7ece7c139a1df9b
MD5 1f56461e3450c0b9a3047e29f88c434c
SHA1 a6b37047e607c6f50932d4740a310c9797a72445
SHA512 6028616ea904ef7d77646d77973f015f695f6bff69276c871fb9321a11eabf46de96eb4d9b633f23bbb24021f17bd98b8b955e2226403634662039e016b68ac4
SSDEEP 3072:IFmxsczyRrAO75U+31DjsAZ8yTyZMCAeABPhyPoJz//hMhfWCMHYHZpsoOFL7jcj:IQ2RrAO7zBjsAjTyZMCAeABPuyznkbM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/584-44-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-51-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-50-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-49-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-48-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-47-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/584-46-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/1564-19-0x0000000001000000-0x0000000001039000-memory.dmp

Download

memory/1564-1-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1564-9-0x0000000000AB0000-0x0000000000AE9000-memory.dmp

Download

memory/1564-0-0x0000000001000000-0x0000000001039000-memory.dmp

Download

memory/2548-43-0x0000000000BA0000-0x0000000000BD9000-memory.dmp

Download

memory/2548-41-0x0000000003600000-0x00000000036BF000-memory.dmp

Download

memory/2548-25-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2548-24-0x0000000000BA0000-0x0000000000BD9000-memory.dmp

Download

memory/2548-20-0x0000000000BA0000-0x0000000000BD9000-memory.dmp

Download

memory/2548-21-0x0000000000020000-0x0000000000022000-memory.dmp

Download