urelas | fbb9b527a4dd30ff8fb8a7767b7ed7bb28fc843ba940f20a221a033101dd37a5

General

Target

79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe
Size

59KB
MD5

79fb56d15ce4fa67610f8424d98745c2
SHA1

d2cb609ef6f88e4dc83c7b055f7ed3b647ffd9ca
SHA256

fbb9b527a4dd30ff8fb8a7767b7ed7bb28fc843ba940f20a221a033101dd37a5
SHA512

8be683bdda697cacc90955bb1c592c4da22bd38220e6eba6661fe792d06c6ff4316bb02386f6a6c4910d47da295e7666020b3aa95f32c85b1240f75d894f24fa
SSDEEP

768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPM:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdf

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2612	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid	Process
2664	biudfw.exe

Loads dropped DLL 1 IoCs

Processes:

79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe

pid	Process
2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exe79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exebiudfw.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2980 wrote to memory of 2664	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2664	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	30
PID 2980 wrote to memory of 2612	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	31
PID 2980 wrote to memory of 2612	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	31
PID 2980 wrote to memory of 2612	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	31
PID 2980 wrote to memory of 2612	2980	79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79fb56d15ce4fa67610f8424d98745c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
55e10a9af74d3f3fa5ae3cb7ff5ad9d4

SHA1
449221fd8d7196a54de2bd583625d8d1b64db56a

SHA256
a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

SHA512
4af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
4d1f05dd0cd00588d93e11c5047dca84

SHA1
bbf62156e29522c5fca4eebcb0a8b8720b822bbc

SHA256
91ad3ef0e4d25dd254339e3b8faf01168d875410623cee737d2f52ab1809a43e

SHA512
5820ef65ddc9e32df111d227cb972f72531233fe3b6d6a3b3794b1576b59ecd24156d1ed407096b304bd140b98be3ab899c6f17e46130e28df2232440e05e703

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
59KB

MD5
6f9e3be368e5274c6c7a590dee60f513

SHA1
e054b93e3295abdb4fd5a969bb27ba0830ada150

SHA256
aa189821233c35adcbd06bdf4f8fdff8754b2170ffa069b08ad0cf0ca6aacf66

SHA512
1a071bf8c875fa3b9f7d9912713d5d15efed3e16730d52c8346b0422b76403427a40523012462583ed40aa64f3e2f8e0fb386573ba4b6ab821d7d5831cca7995

Download Submit
memory/2664-10-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/2664-22-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/2664-24-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/2664-30-0x0000000000020000-0x0000000000055000-memory.dmp

Filesize
212KB

Download
memory/2980-0-0x0000000000B00000-0x0000000000B35000-memory.dmp

Filesize
212KB

Download
memory/2980-6-0x00000000009F0000-0x0000000000A25000-memory.dmp

Filesize
212KB

Download
memory/2980-19-0x0000000000B00000-0x0000000000B35000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads