Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2024 19:16

General

  • Target

    d87385c9bc213e4b3cb27518a3712e41_JaffaCakes118.exe

  • Size

    439KB

  • MD5

    d87385c9bc213e4b3cb27518a3712e41

  • SHA1

    b0c75ec76acf79589b42dd48dd2c38f1d9dd1fac

  • SHA256

    b3e936d140efd7ab76f3650711f3cd974cc1f2e5ed185b08aa85915b1da6e599

  • SHA512

    dff3aa4e100e22d128e2d53105f923bb3456ee08a016862d09b855d0ced2cdaf6027303fedac80e2deca07f0a5f65a30ff9fcd104e06e8a06f6e6970a454da45

  • SSDEEP

    6144:oEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpjS:oMpASIcWYx2U6hAJQnP

Score
10/10

Malware Config

Extracted

Family

urelas

C2

218.54.31.165

218.54.31.226

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Urelas family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d87385c9bc213e4b3cb27518a3712e41_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d87385c9bc213e4b3cb27518a3712e41_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\guler.exe
      "C:\Users\Admin\AppData\Local\Temp\guler.exe" hi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\Temp\upneve.exe
        "C:\Users\Admin\AppData\Local\Temp\upneve.exe" OK
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Users\Admin\AppData\Local\Temp\fumuz.exe
          "C:\Users\Admin\AppData\Local\Temp\fumuz.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2660
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2632
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    224B

    MD5

    cce71f3d8ef465a418dc5d412017da33

    SHA1

    1d4abb870d2e9d07465f2b7071093896bf1bf09f

    SHA256

    c0af8f991fb2f41870ffcce9e038919464bcd2aa49216d2b74409571bfeafdb9

    SHA512

    d8a9e20132f369eba5b83195fa6e79cf53e4f5fec585a13cd99e7fbc57f399e2b127a43848ec7c61a63aa138d794e9d6fb26f6760a9dbb323d48e93f2ca9eed5

  • C:\Users\Admin\AppData\Local\Temp\_vslite.bat

    Filesize

    304B

    MD5

    11c0466e0dc6e88b7901554ab27bf078

    SHA1

    73cf6251987bb89fb2ca933243ed464d9aca6f1e

    SHA256

    a5ff84be6e909f48c7a803ed42d1c02f3eb4920822e32f1f69ad6cb03065debb

    SHA512

    ab458b856cf6a2cecf62a603c9d057a418b32fc370fa02d2049fdde0c8ec5dfec51b7ee5049b969d7677970b39b2bc6d116a6acdf22cdca21d26b102d49c0f7e

  • C:\Users\Admin\AppData\Local\Temp\fumuz.exe

    Filesize

    223KB

    MD5

    4bbee5ca7fc56e8935cb6bd5e5891816

    SHA1

    eac2d5df2d80798954da2bc5190265274d614f1b

    SHA256

    23708fda9be74ee1b191e3e9cfb9c3dadbc72fe79abe93264333db109f5574d9

    SHA512

    6491c668e391a07aa3069002a991477227813dce56a971af30671bcb7732bed66440a604b7abfca9d7eea2da9d2882eb11eabcf42dbfabc34bb49f16090f59b1

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    a75153fba4514cbbc6910bb7c44eb682

    SHA1

    91cd422c9ecf5188e083e4972e6bdad13d18c1d4

    SHA256

    cee75d62d4038c64c6a12a21f5e4b74f51e39a6bec8d3a9f047623abd3f238b4

    SHA512

    3c7de15c67dba2179055fa2124fa227745251141b2f3bcabfec59a1786ee5453b5872fd1f53fd874d147fea5aad7dcfbd6aa9925aa8afd59ce3293a3b94db479

  • C:\Users\Admin\AppData\Local\Temp\upneve.exe

    Filesize

    439KB

    MD5

    0b023de5efbcc8786b9102dbe01e0c68

    SHA1

    31fd8c85aecf66c15908f2e93f05a2ad99b2b36d

    SHA256

    bc95731f705202c7dc8bc29935106baf87b7ab21b66d3f2c5c9f468a26d82de6

    SHA512

    d8ab981c9ea8d83a23c1f7424c868b7085d106652560efcec12a5927c21c35cacc290a68e006b3f0792f772319643f7ef10ee5add6737686e116a12367739dbc

  • \Users\Admin\AppData\Local\Temp\guler.exe

    Filesize

    439KB

    MD5

    a2f25cf41ffb44e9f98981fc72288b81

    SHA1

    6fe04602bb7f61350d8ccedb34146c9a7a9bb506

    SHA256

    dda4fd1021a6489fc0582b2d75a163646163c3e8f2c867b412698fb58477e74f

    SHA512

    df6ca94725e77f2d790232b39ef07f9d1c113e3ec990dea7cc7aa29c3aec388d03d54449226a9607a1410ea2e83a63097e7fdefefa0c13394b4f19e27a08b5d9

  • memory/2660-50-0x0000000000130000-0x00000000001D0000-memory.dmp

    Filesize

    640KB

  • memory/2660-51-0x0000000000130000-0x00000000001D0000-memory.dmp

    Filesize

    640KB

  • memory/2660-54-0x0000000000130000-0x00000000001D0000-memory.dmp

    Filesize

    640KB

  • memory/2660-53-0x0000000000130000-0x00000000001D0000-memory.dmp

    Filesize

    640KB

  • memory/2660-52-0x0000000000130000-0x00000000001D0000-memory.dmp

    Filesize

    640KB

  • memory/2700-8-0x00000000026E0000-0x000000000274E000-memory.dmp

    Filesize

    440KB

  • memory/2700-19-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2700-0-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2788-27-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2788-18-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2888-30-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2888-46-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

  • memory/2888-37-0x0000000002F20000-0x0000000002FC0000-memory.dmp

    Filesize

    640KB

  • memory/2888-28-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB