urelas | 027b385c097c99f387f21b85a19024ee4df4f929a7fe937cd3eefa79bb95e466

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe
Size

412KB
MD5

d21aa47efc1d5b055f883efb6a4ed8f2
SHA1

8a30acf6ab25116d261ac3e4e3c4a12c92cc2f69
SHA256

027b385c097c99f387f21b85a19024ee4df4f929a7fe937cd3eefa79bb95e466
SHA512

e807f75699f499e5e3bafe276a57dc1664a9ae46d0088df14e90457c7fed67c828654e8ae58ae032b78ad826e8fc551863f24a7259c515d763106d04fe8f5344
SSDEEP

6144:kzU7blKaP2iCWhWapKRaRXOkN4Swel6f3IsInOYO:eU7M5ijWh0XOW4sEfeOj

Score

10^/10

urelas aspackv2 discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0003000000000705-21.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	demuy.exe

Executes dropped EXE 2 IoCs

pid	Process
1820	demuy.exe
3572	eklui.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	demuy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eklui.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe
3572	eklui.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 1820	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	83
PID 3940 wrote to memory of 1820	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	83
PID 3940 wrote to memory of 1820	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	83
PID 3940 wrote to memory of 3932	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	84
PID 3940 wrote to memory of 3932	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	84
PID 3940 wrote to memory of 3932	3940	d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe	84
PID 1820 wrote to memory of 3572	1820	demuy.exe	103
PID 1820 wrote to memory of 3572	1820	demuy.exe	103
PID 1820 wrote to memory of 3572	1820	demuy.exe	103

C:\Users\Admin\AppData\Local\Temp\d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d21aa47efc1d5b055f883efb6a4ed8f2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\demuy.exe
  "C:\Users\Admin\AppData\Local\Temp\demuy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\eklui.exe
    "C:\Users\Admin\AppData\Local\Temp\eklui.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
77456288d1276b245fb463c4bd96c3d3

SHA1
01b29eb423224439fdfa00521ce955b04a0ca540

SHA256
45e57bf84d6e00efab5b2f4180cfaba042e2e452acf40d4c2cc7ffe26236b517

SHA512
21b999d0366cbd9fe0684fddf45a74f4c394673aa9d0d21598465cf7fb43bf912bdb11a4efeaa17c12e6d56183fa1ad601f6c402efca47e13844bd1f34adb684

Download Submit
C:\Users\Admin\AppData\Local\Temp\demuy.exe

Filesize
412KB

MD5
bf92c4582a6d73d1cc941a07273c5eba

SHA1
eae43327b81008ae5a61dc4a7507380751154905

SHA256
847c7498c1bfafec7df3e65ba88ff5a55199b2518f42de39965e4088f01e00c6

SHA512
460f9fa3985122c7fc42740fbaddd05616c69651bf316f8ae77dd164b42807f0e071f8c047335c4cad83b204805250cb07d8be31bee261682a4f0a0a61deb4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\eklui.exe

Filesize
212KB

MD5
6bdf7e46a57f25992bbc06141ca1341b

SHA1
e86460f78cfe23802b0a75fe8a749f881972df19

SHA256
4489ceae4f2e416687ffe1ab7d01d0c4edce5f10cd1204bc3240eccddbb5ade4

SHA512
f81caf902afc5ab0a06311ada970f99ea47d044159bfa56d067f115fd66bd4ff07a2f97d107fc8b6eb1c0635a55155edfbea7aaea8d7bef6ddeb8f404125259d

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
4f71d30789036d2191e11c57de1f088a

SHA1
8d9c906063268bc0198f90191043a90cdb24a6cb

SHA256
89eb375dd2b149efdc76c9efbecf0bca60f56330f0334e44afdd789ed7e279e8

SHA512
3803f39bdff93da637cccb2dd9e846f69489282f94ee87fa9ba9f7343bedd223cad3f56057168270a4b6aa94f3b2b22d0e0a94deb20e63e52e6ad27d220bfc04

Download Submit
memory/1820-29-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1820-16-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3572-27-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-28-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-26-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-25-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-31-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-32-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-33-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-34-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3572-35-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3940-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/3940-13-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download