urelas | 7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
Size

108KB
MD5

8e3ea403df9de189ae02117cd58bde38
SHA1

d80f2b2e5afa45505e72a9717462f38e989a966f
SHA256

7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9
SHA512

83cca9358360383acf50b0477c1735a34e24ac2cfcea9df3fcb6c8d8f85f9d3880afd4b3d0fa4e1f1b8d789ef09fb1fad2d4e5b5be4882ea2f52d3ccc673fd53
SSDEEP

1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjb:4tCc+/h0fmSid81L64TGVb

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1224	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1224	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	87
PID 4612 wrote to memory of 1224	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	87
PID 4612 wrote to memory of 1224	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	87
PID 4612 wrote to memory of 1640	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	88
PID 4612 wrote to memory of 1640	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	88
PID 4612 wrote to memory of 1640	4612	8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
108KB

MD5
0fbbacb724d0945c9a12882544988723

SHA1
d5775dc2a631ea452bc5e3d4da98baaa0a51deab

SHA256
e8a2a64b3c29f02db1b961762ed1ab12a46363ee0c5b582c87b7d5e7e3d56dd8

SHA512
7e9f28807241b52e09aa1885399889c9ae30ebadcadb66c39d7a3be365a4a6345dd8b45e4d2c62d13490430ce401daf1ce0727917ec11c40ff63ef07585f2a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
429d29b7501cff75ffd4e7af0b24db41

SHA1
53808fde744d4d65aa2f4c48e8644a65f81be038

SHA256
8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

SHA512
83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
0817cb7228f849157bf82bda23580e80

SHA1
70d290fd3e4d99aba41577fce2e9160396a9be8f

SHA256
45553da2ef6c66b56ed8091214566920fed73676cd071c76709da2caebd240b8

SHA512
97ec27670af5bf87c55e280091818e48e73d7184022c5f133a6de407f128a86b0f7a9a5174612debe971384519681e0e7d0ab1ba79a89c0d0088abc85abca2e0

Download Submit
memory/1224-12-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/1224-17-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/1224-18-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/4612-0-0x0000000000D60000-0x0000000000D84000-memory.dmp

Filesize
144KB

Download
memory/4612-14-0x0000000000D60000-0x0000000000D84000-memory.dmp

Filesize
144KB

Download