urelas | 577346c68b2c6aae31ccc7ff0c8f325d5579ebc35c257996b69e3cb009eab0a4

General

Target

846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe
Size

510KB
MD5

846296e641ca832b0fcb1d9e127968a8
SHA1

cb914f7418641a1f5226ec7bc46c066e54c69ec3
SHA256

577346c68b2c6aae31ccc7ff0c8f325d5579ebc35c257996b69e3cb009eab0a4
SHA512

f3852c8b032681aff93c00f869e69b5667a0caf768323aff0b92fb7449783022343c3eb627ccbea560cf0ad356fc51a1775dd7ceb19a0f2672417fc9e09028b3
SSDEEP

12288:j/fCEOMsm8nc3qWQ8wqKhb43nLl5tDrXlFu:j/D0caF8wvhb43pDbu

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exevuzuf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	vuzuf.exe

Executes dropped EXE 2 IoCs

Processes:

vuzuf.exerumob.exe

pid process

3176 vuzuf.exe
2004 rumob.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3176	vuzuf.exe
2004	rumob.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exevuzuf.execmd.exerumob.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vuzuf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rumob.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rumob.exe

pid	process
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe
2004	rumob.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exevuzuf.exe

description	pid	process	target process
PID 2724 wrote to memory of 3176	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	vuzuf.exe
PID 2724 wrote to memory of 3176	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	vuzuf.exe
PID 2724 wrote to memory of 3176	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	vuzuf.exe
PID 2724 wrote to memory of 4160	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	cmd.exe
PID 2724 wrote to memory of 4160	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	cmd.exe
PID 2724 wrote to memory of 4160	2724	846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 2004	3176	vuzuf.exe	rumob.exe
PID 3176 wrote to memory of 2004	3176	vuzuf.exe	rumob.exe
PID 3176 wrote to memory of 2004	3176	vuzuf.exe	rumob.exe

C:\Users\Admin\AppData\Local\Temp\846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\846296e641ca832b0fcb1d9e127968a8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\vuzuf.exe
  "C:\Users\Admin\AppData\Local\Temp\vuzuf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Users\Admin\AppData\Local\Temp\rumob.exe
    "C:\Users\Admin\AppData\Local\Temp\rumob.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
9086d16211c62d6491ecdc09d1fe0536

SHA1
026dd163e6e578d7898e24a01cd156d2f615fed7

SHA256
c43d63b1bd5c057518899c8bd6d68fb4209f38fd4e62575efcabc572c4ab494f

SHA512
fbc917028b7b90aae2ca22739f0aab6867b9ac1fb6ebd921f34744807ca9126a1e1f1e4af90e192085ded3350043fbec1606af9825d2a02a1e8e9e4e34eba0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
92545aec9962b51a49b9e2fa593f16d2

SHA1
b8e2efc0b61c0245e7b893268d4573b0efb5cb4e

SHA256
7b4e9745ec2eebc1278402b135066b7a3a70d55c568355e43f6b0b20126bbd46

SHA512
9a391de960d70c47585b5d44ad425c76125b1b049179cf39612bc26273943accea08edcd0663dcff5612303930d52c66bbf755ae7baf7c15549a58553296657f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rumob.exe

Filesize
218KB

MD5
a5491cf4aaddab724f2b5bf31f2cf6d6

SHA1
d8c6e6dae085acec502e0305d008f32997c13fb4

SHA256
8aefa155ffd692027ee8c3c242a57f5b9f1e83052490001345720e6c5d637c88

SHA512
5bc82615f7ee6fb497f5081604d7fc7e6da27c94e03947ad235760743ab7f33bb7394296f3157fbd2f856bb86ff11509310ac6bb9bbce5c2b39e36b8ca55197b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vuzuf.exe

Filesize
510KB

MD5
bb54369536ec5ac7ce27a56083980d15

SHA1
420ddfa032471a8d8627f01fae77e9eacf1bb13b

SHA256
12034adcf347a6840c053966b9988a62ccbe801da889035578c5551513af5926

SHA512
267b504c9d20fe3460acbb020f62439cfad1c19195909f42f5e8b16fcb045e0fb224fcb6ade09e6e133ea3cdf26b84048d0c0dd455bcad4cc762eb50488f8e1c

Download Submit
memory/2004-27-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/2004-26-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2004-31-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/2004-30-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2004-32-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2004-33-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2004-34-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2004-35-0x0000000000B50000-0x0000000000C0B000-memory.dmp

Filesize
748KB

Download
memory/2724-14-0x0000000000540000-0x00000000005C6000-memory.dmp

Filesize
536KB

Download
memory/2724-0-0x0000000000540000-0x00000000005C6000-memory.dmp

Filesize
536KB

Download
memory/3176-17-0x0000000000D30000-0x0000000000DB6000-memory.dmp

Filesize
536KB

Download
memory/3176-10-0x0000000000D30000-0x0000000000DB6000-memory.dmp

Filesize
536KB

Download
memory/3176-28-0x0000000000D30000-0x0000000000DB6000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads