urelas | 4648dc39011103627aed6ed0617161366b4f639495cca96453e3329234cfac51

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/12/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
Size

199KB
MD5

d33ee8e247164cef0492d70ee2502704
SHA1

502870ad82f5956969fc9a3ad9bb7f444115bc5a
SHA256

4648dc39011103627aed6ed0617161366b4f639495cca96453e3329234cfac51
SHA512

84a46f7ce42c17e9c99cf825b520269b51f55eb887da9401746c85080afd509663f58c089805f1551947f1ac06f2001aa65e4c6ebe4cae07896c14e9f952fec9
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhA6:gExhk7rh7NEOIYWlPM6r6f

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2780	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1096	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	31
PID 1780 wrote to memory of 1096	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	31
PID 1780 wrote to memory of 1096	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	31
PID 1780 wrote to memory of 1096	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	31
PID 1780 wrote to memory of 2780	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	32
PID 1780 wrote to memory of 2780	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	32
PID 1780 wrote to memory of 2780	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	32
PID 1780 wrote to memory of 2780	1780	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
6a88a3ec9b32c1e9b89a0d8d9fa26815

SHA1
48fae8644be4a05b4b35193d545f6e89c82fc00c

SHA256
a08ae732d6c04b5ab932ad7968bebe4c5a6d03c2b0f8ce8315a0bfe5809f6da7

SHA512
7919d42b5e461fb7d130c71f0d12cbb446d4ff71358624e78b6713ddcbf1ac4be9d406afdfc07986c424be19ab7e2d255993261af74aea07b17bf96eec02eb27

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
200KB

MD5
8781b6eb8e69d36d6cdd1dac6566602e

SHA1
4013e9f94eb8f9cbc4b8171113bdd9935913b822

SHA256
83e7c700109e516a8550bd2961799e5c09e50053a72e574e54f20fc423acdb1f

SHA512
39bab1fc19a1b76b9ceed0aaabfecf036fd8a4258870129f6b1fbc22362b1a6aa24db4115bb7b3d638de86fbbee66a4ca58b0b7d8e2545b85779e627f3dbeac0

Download Submit
memory/1096-16-0x0000000000850000-0x0000000000884000-memory.dmp

Filesize
208KB

Download
memory/1096-21-0x0000000000850000-0x0000000000884000-memory.dmp

Filesize
208KB

Download
memory/1096-22-0x0000000000850000-0x0000000000884000-memory.dmp

Filesize
208KB

Download
memory/1780-0-0x0000000000B00000-0x0000000000B34000-memory.dmp

Filesize
208KB

Download
memory/1780-8-0x0000000000A50000-0x0000000000A84000-memory.dmp

Filesize
208KB

Download
memory/1780-18-0x0000000000B00000-0x0000000000B34000-memory.dmp

Filesize
208KB

Download