urelas | f55565628e4868db116845182a1cec78ad86014d3f0b9255d141e32fb0781e05

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/10/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe
Size

192KB
MD5

5cfcd8adb38de8f24e9d00b3492ccc86
SHA1

b0d69d43695e044d03dfba9eea63af58e674d61f
SHA256

f55565628e4868db116845182a1cec78ad86014d3f0b9255d141e32fb0781e05
SHA512

4e65ca151973c9d70d8468f7bc83c09fab4a72a0349621ec04a47ed23566f17bdd81fc2ca6b4f6b8544b65d7d4778ab53b14581e728d20cdf519fdfa2e1c5967
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhf:gExhk7rh7NEOIYWlPM6r6f

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas

Deletes itself 1 IoCs

pid	Process
2284	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2068	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2068	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2068	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2068	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2284	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	31
PID 2420 wrote to memory of 2284	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	31
PID 2420 wrote to memory of 2284	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	31
PID 2420 wrote to memory of 2284	2420	5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cfcd8adb38de8f24e9d00b3492ccc86_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
27fea5448b11d53b9fe6488ff9c04415

SHA1
e023da5aff3f7bdeb0064f6f1486b7b13d3ed2d3

SHA256
0d04ea4e5ca097d25b3a2581b0ffc7a71022b77eea66763851782c665efede4b

SHA512
4974be51e196c35ae3fa6b0f51c640b8197c31a4615eccf6fa371fed7acf39b0df0d74b3ac290173e81f9f6d847a5eb963dad723fb8e8c93616f781821fbeeda

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
192KB

MD5
7409a774334a0f794234b1d985d13986

SHA1
89a85a55698c9c41d5229d969a7c4b543bbde54f

SHA256
b80825fdc51e93390608016e75dbed54215af9d19c57f06fb1a18de1bd9a2bd7

SHA512
4a64b1658e55b0256a006a7a09c769eb46403e8b53329a75cf646e6704c5434a02952ee8ca5903112718a3c3ee01c64a6523ce976e120266a520d3a53f57e854

Download Submit
memory/2068-10-0x0000000000B10000-0x0000000000B44000-memory.dmp

Filesize
208KB

Download
memory/2068-21-0x0000000000B10000-0x0000000000B44000-memory.dmp

Filesize
208KB

Download
memory/2068-22-0x0000000000B10000-0x0000000000B44000-memory.dmp

Filesize
208KB

Download
memory/2420-0-0x0000000000360000-0x0000000000394000-memory.dmp

Filesize
208KB

Download
memory/2420-18-0x0000000000360000-0x0000000000394000-memory.dmp

Filesize
208KB

Download
memory/2420-8-0x0000000001E60000-0x0000000001E94000-memory.dmp

Filesize
208KB

Download