urelas | a1e28080186d3bc8981035936eefe80fbb9881c65ade1de23acc567e586cc028

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe
Size

50KB
MD5

8815bdc151e0e79afabde0dce90d15b8
SHA1

c45efde97a621d6460ce8ad22a7458c3e577ba43
SHA256

a1e28080186d3bc8981035936eefe80fbb9881c65ade1de23acc567e586cc028
SHA512

bbf9566e5fe1d015f5becac0c5dc82ca2d5076805977fd3985fe412e0456072251abb62bfb39582da188f6ade67b745e58910540873066a0c9e470195d649ee7
SSDEEP

1536:834/PC7Ruz3hRXRASULZ6JKYdbzcmhCZnv2:It7R8fU6n8u

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	mokdhft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mokdhft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4876	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	90
PID 4836 wrote to memory of 4876	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	90
PID 4836 wrote to memory of 4876	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	90
PID 4836 wrote to memory of 3464	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	91
PID 4836 wrote to memory of 3464	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	91
PID 4836 wrote to memory of 3464	4836	8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8815bdc151e0e79afabde0dce90d15b8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\mokdhft.exe
  "C:\Users\Admin\AppData\Local\Temp\mokdhft.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
39e55c2b5135dd669ad371cc03d79fc2

SHA1
d027fea84a269f8e556dfb5411ac3d01b9311017

SHA256
ecf7b9f0150af34b1d09f4602f0acf31445ff28e40b2411b0e32180bb8672919

SHA512
e75942d900b97d254097d8a44bfde16bdc99cc0f124541316a0987b2fb5433b7b1f12d4eff8b47d05e9068e7a038e4dd92998646448dcb0d6615a81a561ef280

Download Submit
C:\Users\Admin\AppData\Local\Temp\mokdhft.exe

Filesize
50KB

MD5
098c25c0c6b30dc4e55d21608afa65a1

SHA1
5263081dcd37bacde8c18e3332caa2e72af26ad6

SHA256
2866387257b4686f5bed072bd9a5164daf1d451f8ddc7f057c26257255250e58

SHA512
0c35f8952304a68f9442718347b9f73a4aaac076da9afd246832b1eb4dd3b2029c02222d43904fea09077f48e82741535b6491c0968db14a54079ad6ee35f58d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
9324d198ed1e468c5b1546bd767d4975

SHA1
a0d25905889c1d2496a7095c0b9c35daa0efe7c3

SHA256
8574d691fa56b0d5405c65b51df9525397b18715d9a94a92e049a822e7f386b7

SHA512
928598fddf464ae000eca02ab6c456679e19ed1cbebf999a920dc61006e2e71363f67b29ef91798e8430c77ee9e5a56c84758f63f2c528e850654339f717d773

Download Submit
memory/4836-0-0x0000000000C30000-0x0000000000C63000-memory.dmp

Filesize
204KB

Download
memory/4836-14-0x0000000000C30000-0x0000000000C63000-memory.dmp

Filesize
204KB

Download
memory/4876-11-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/4876-17-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/4876-19-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download
memory/4876-26-0x0000000000260000-0x0000000000293000-memory.dmp

Filesize
204KB

Download