Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 00:26

General

  • Target

    8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe

  • Size

    108KB

  • MD5

    8e3ea403df9de189ae02117cd58bde38

  • SHA1

    d80f2b2e5afa45505e72a9717462f38e989a966f

  • SHA256

    7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9

  • SHA512

    83cca9358360383acf50b0477c1735a34e24ac2cfcea9df3fcb6c8d8f85f9d3880afd4b3d0fa4e1f1b8d789ef09fb1fad2d4e5b5be4882ea2f52d3ccc673fd53

  • SSDEEP

    1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjb:4tCc+/h0fmSid81L64TGVb

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1224
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

    Filesize

    108KB

    MD5

    0fbbacb724d0945c9a12882544988723

    SHA1

    d5775dc2a631ea452bc5e3d4da98baaa0a51deab

    SHA256

    e8a2a64b3c29f02db1b961762ed1ab12a46363ee0c5b582c87b7d5e7e3d56dd8

    SHA512

    7e9f28807241b52e09aa1885399889c9ae30ebadcadb66c39d7a3be365a4a6345dd8b45e4d2c62d13490430ce401daf1ce0727917ec11c40ff63ef07585f2a2b

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    429d29b7501cff75ffd4e7af0b24db41

    SHA1

    53808fde744d4d65aa2f4c48e8644a65f81be038

    SHA256

    8076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7

    SHA512

    83516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07

  • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

    Filesize

    302B

    MD5

    0817cb7228f849157bf82bda23580e80

    SHA1

    70d290fd3e4d99aba41577fce2e9160396a9be8f

    SHA256

    45553da2ef6c66b56ed8091214566920fed73676cd071c76709da2caebd240b8

    SHA512

    97ec27670af5bf87c55e280091818e48e73d7184022c5f133a6de407f128a86b0f7a9a5174612debe971384519681e0e7d0ab1ba79a89c0d0088abc85abca2e0

  • memory/1224-12-0x0000000000470000-0x0000000000494000-memory.dmp

    Filesize

    144KB

  • memory/1224-17-0x0000000000470000-0x0000000000494000-memory.dmp

    Filesize

    144KB

  • memory/1224-18-0x0000000000470000-0x0000000000494000-memory.dmp

    Filesize

    144KB

  • memory/4612-0-0x0000000000D60000-0x0000000000D84000-memory.dmp

    Filesize

    144KB

  • memory/4612-14-0x0000000000D60000-0x0000000000D84000-memory.dmp

    Filesize

    144KB