urelas | 4648dc39011103627aed6ed0617161366b4f639495cca96453e3329234cfac51

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
Size

199KB
MD5

d33ee8e247164cef0492d70ee2502704
SHA1

502870ad82f5956969fc9a3ad9bb7f444115bc5a
SHA256

4648dc39011103627aed6ed0617161366b4f639495cca96453e3329234cfac51
SHA512

84a46f7ce42c17e9c99cf825b520269b51f55eb887da9401746c85080afd509663f58c089805f1551947f1ac06f2001aa65e4c6ebe4cae07896c14e9f952fec9
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhA6:gExhk7rh7NEOIYWlPM6r6f

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2684	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	83
PID 2756 wrote to memory of 2684	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	83
PID 2756 wrote to memory of 2684	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	83
PID 2756 wrote to memory of 116	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	84
PID 2756 wrote to memory of 116	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	84
PID 2756 wrote to memory of 116	2756	d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d33ee8e247164cef0492d70ee2502704_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
199KB

MD5
325418b8b00ce766f3c06e1ab8d667c6

SHA1
12b93eaa715594e0678081a6b773d2060196a6e0

SHA256
3d860347ec4abffee4c4aad812a3cb482335cc70a494f61dc3589affef1ec6df

SHA512
570bbb4113b0b42f0534e0cf5b160d951866b133055ea440a449563be0da961a21548c08d39b583dbd66f7df78c2ae90fa437c5c074a3745b783035e724955cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
6a88a3ec9b32c1e9b89a0d8d9fa26815

SHA1
48fae8644be4a05b4b35193d545f6e89c82fc00c

SHA256
a08ae732d6c04b5ab932ad7968bebe4c5a6d03c2b0f8ce8315a0bfe5809f6da7

SHA512
7919d42b5e461fb7d130c71f0d12cbb446d4ff71358624e78b6713ddcbf1ac4be9d406afdfc07986c424be19ab7e2d255993261af74aea07b17bf96eec02eb27

Download Submit
memory/2684-10-0x0000000000DA0000-0x0000000000DD4000-memory.dmp

Filesize
208KB

Download
memory/2684-17-0x0000000000DA0000-0x0000000000DD4000-memory.dmp

Filesize
208KB

Download
memory/2684-18-0x0000000000DA0000-0x0000000000DD4000-memory.dmp

Filesize
208KB

Download
memory/2756-0-0x0000000000C20000-0x0000000000C54000-memory.dmp

Filesize
208KB

Download
memory/2756-14-0x0000000000C20000-0x0000000000C54000-memory.dmp

Filesize
208KB

Download