urelas | 7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9

Analysis

max time kernel
90s
max time network
96s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
Size

108KB
MD5

8e3ea403df9de189ae02117cd58bde38
SHA1

d80f2b2e5afa45505e72a9717462f38e989a966f
SHA256

7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9
SHA512

83cca9358360383acf50b0477c1735a34e24ac2cfcea9df3fcb6c8d8f85f9d3880afd4b3d0fa4e1f1b8d789ef09fb1fad2d4e5b5be4882ea2f52d3ccc673fd53
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjb:4tCc+/h0fmSid81L64TGVb

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
3032	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2244	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2244	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2244	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2244	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	30
PID 2528 wrote to memory of 3032	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	31
PID 2528 wrote to memory of 3032	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	31
PID 2528 wrote to memory of 3032	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	31
PID 2528 wrote to memory of 3032	2528	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
0817cb7228f849157bf82bda23580e80

SHA1
70d290fd3e4d99aba41577fce2e9160396a9be8f

SHA256
45553da2ef6c66b56ed8091214566920fed73676cd071c76709da2caebd240b8

SHA512
97ec27670af5bf87c55e280091818e48e73d7184022c5f133a6de407f128a86b0f7a9a5174612debe971384519681e0e7d0ab1ba79a89c0d0088abc85abca2e0

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
108KB

MD5
9f6c6dbf2859d5cd01c42d13c2de23a5

SHA1
5996c8da5e86b82884a66452cacf7bd1c1597bdf

SHA256
b7158604699154f4d5eaca7ca98eff49ae955a7f2cca10bddd2cbdc483947a5a

SHA512
ff252e6f88997d57731f4228ba035ade1897a34a85bdf5b8019c7d39cece432c1b294d2483502e08e9a15d94d6961b99ca12e25625b760f2faeffb272dd8ea4a

Download Submit
memory/2244-10-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

Filesize
144KB

Download
memory/2244-21-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

Filesize
144KB

Download
memory/2244-22-0x0000000000FA0000-0x0000000000FC4000-memory.dmp

Filesize
144KB

Download
memory/2528-0-0x0000000000DD0000-0x0000000000DF4000-memory.dmp

Filesize
144KB

Download
memory/2528-6-0x0000000000450000-0x0000000000474000-memory.dmp

Filesize
144KB

Download
memory/2528-18-0x0000000000DD0000-0x0000000000DF4000-memory.dmp

Filesize
144KB

Download