urelas | 7e195b782763cb39ec2332db1390fd32b4ae9649a812ca6b52f99071e5219eff

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe
Size

442KB
MD5

d11c187b8defc3b89cd805739a488139
SHA1

e49d7fafbefc88333789ccab02a525277e86e75f
SHA256

7e195b782763cb39ec2332db1390fd32b4ae9649a812ca6b52f99071e5219eff
SHA512

333edf7d59372c2828a9862b28593578fbf4c5742d1f262af6285425c3dd8f109ba9a282f52a29c087aa4108e5a011593aa97b2f36cd5603bb9eded5a3625bb9
SSDEEP

6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMby:rKf1PyKa2H3hOHOHz9JQ6zBx

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.165

218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	jodou.exe

Executes dropped EXE 2 IoCs

pid	Process
3688	jodou.exe
2672	mufud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jodou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mufud.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe
2672	mufud.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3688	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	82
PID 4876 wrote to memory of 3688	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	82
PID 4876 wrote to memory of 3688	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	82
PID 4876 wrote to memory of 4560	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	83
PID 4876 wrote to memory of 4560	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	83
PID 4876 wrote to memory of 4560	4876	d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe	83
PID 3688 wrote to memory of 2672	3688	jodou.exe	94
PID 3688 wrote to memory of 2672	3688	jodou.exe	94
PID 3688 wrote to memory of 2672	3688	jodou.exe	94

C:\Users\Admin\AppData\Local\Temp\d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d11c187b8defc3b89cd805739a488139_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\jodou.exe
  "C:\Users\Admin\AppData\Local\Temp\jodou.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\mufud.exe
    "C:\Users\Admin\AppData\Local\Temp\mufud.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
91ef046b9570729f0fce7390f1fa99d6

SHA1
ff265a9d0bbdd26af4f3c0fb7d26723b783a3555

SHA256
60d6dd84e1ecb9a225d0b42bf4d4c46dcb51619c9591b02de8a7c24421f1da53

SHA512
6fb8b01250e13360165ad988f00763e94a32b7ed6a8ee523d6ca4c603d1bbb63f2a58e283086bc4c0828b89faeb8b195ffbc5617f7d925396928602b191bcd7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e99aec9951f2dca7de8ce6d910ec24a4

SHA1
104981f3ec4e96a4d709a0d20841b9962ba147eb

SHA256
2eb918baf350e6c50594e4c87a6bbaa79d12e3ad7511b9b60bb7a11e746ac21d

SHA512
6fc69a094a776366b5d15c7a421d1aaddd3bb850b14319bdf3766bbeb6daf3b097cdb488ad72fc5f88da864f12857f3d862ae955160d57a265af0c51581e2ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\jodou.exe

Filesize
442KB

MD5
26939c2ca971f5b7c9d353a4d5cd98c0

SHA1
b35fc75b03f9a38c60a0f6f1508fca31bcc01503

SHA256
9a0935dbdf4171f1d5d710016fd3476dc0154300db7c5611122dd16cdb51c1ca

SHA512
b5c4acfeb6d397883bdcc367e9061320686f2b140a148eda3c451b22e244ad0c2a6391f01e3a0cfee28c6f4149f8c7c3bec7bd0208a8679e83c5d9fdc6108edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\mufud.exe

Filesize
230KB

MD5
97e13422ce0a22379a5e2492e527e79f

SHA1
25ab8aa7dbcc57ed59f81d360ae141b474a0037f

SHA256
a595f5b99542e4a77ad9e16601e05061a80eb97a9351549f40d7486c97d93522

SHA512
77245c9ea31509cac42734decdd2262b05d9dd9eb0ead0813b109fd19bb380bbb1810f493202d3e5f2412ecd5a6de66f60329de7a245d7064307a272828ab6cd

Download Submit
memory/2672-25-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/2672-28-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2672-30-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/2672-31-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/2672-32-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/2672-33-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/2672-34-0x00000000004B0000-0x000000000054E000-memory.dmp

Filesize
632KB

Download
memory/3688-17-0x0000000000A50000-0x0000000000ABE000-memory.dmp

Filesize
440KB

Download
memory/3688-10-0x0000000000A50000-0x0000000000ABE000-memory.dmp

Filesize
440KB

Download
memory/3688-27-0x0000000000A50000-0x0000000000ABE000-memory.dmp

Filesize
440KB

Download
memory/4876-14-0x00000000001D0000-0x000000000023E000-memory.dmp

Filesize
440KB

Download
memory/4876-0-0x00000000001D0000-0x000000000023E000-memory.dmp

Filesize
440KB

Download