urelas | c9147949260f059cb9a5c6408872ce1a824d8e23a5ac3f02fa76fdb2323b3bfe

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe
Size

185KB
MD5

d31ba1b907cf5e975df0fe48480cd01a
SHA1

6a99f0e07f06b943b4404d24a67b07e47a1a7895
SHA256

c9147949260f059cb9a5c6408872ce1a824d8e23a5ac3f02fa76fdb2323b3bfe
SHA512

95baaa622cf0d88f7829622556e3aa34f4a279243459794b0d94199726a88db3ec5a21c58c7c03040fc8556af64cfd2462c676887f4b05e1fb598f3416b500c1
SSDEEP

3072:u3mvqCDm+W03RB5eUp6UlD/mUKissApfA6y4YHFcK:2mvqeP33AYFIN9treHeK

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2800	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2764	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2764	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2764	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2764	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2800	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2800	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2800	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2800	2372	d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d31ba1b907cf5e975df0fe48480cd01a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
f35bce135d7bab32e974b4b86f50230c

SHA1
d61403030d3a5337f5fec9982f51eced65fcec44

SHA256
a638f666cae7a26a63062622d46d881808363e03a8831d5a70f2ef1b8cae5199

SHA512
5f5c80bc790fabc722f86c11c2b0d75aa315312f4736290fe5f0bd3dd9a2e61535999544777b8cd35648de2daba82488f470a8edfd904e783ed9f95fbfa4deed

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
185KB

MD5
5de6461285f9a07fcf75f0fbda5571fe

SHA1
03af530c2c8db34f106f0cac83d3c9aba542ed14

SHA256
5aafdfc783ec38176e244209feed84b2ac10b7d7f8764c92954ac8bdd79a53b0

SHA512
969375e6b778cbdf35f4e06b3ca1fa0397a0d6d06a117634664b2661c2dea51ceb69e06ca6326641fba69e0bf67b2d18b052159fc6a62a913cda90bb28c0083f

Download Submit
memory/2372-0-0x0000000000D10000-0x0000000000D42000-memory.dmp

Filesize
200KB

Download
memory/2372-8-0x0000000000500000-0x0000000000532000-memory.dmp

Filesize
200KB

Download
memory/2372-18-0x0000000000D10000-0x0000000000D42000-memory.dmp

Filesize
200KB

Download
memory/2764-10-0x0000000000280000-0x00000000002B2000-memory.dmp

Filesize
200KB

Download
memory/2764-21-0x0000000000280000-0x00000000002B2000-memory.dmp

Filesize
200KB

Download
memory/2764-22-0x0000000000280000-0x00000000002B2000-memory.dmp

Filesize
200KB

Download