urelas | c1bb46519446a732665bf0bff9bf3f0b64ee57b909e65019521e98f5d0b3e65b

Analysis

max time kernel
89s
max time network
80s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe
Size

192KB
MD5

e1dd9f93d95a85af03b136f420884518
SHA1

5006e9c467ac8e1d432590db24ab98e3668644ca
SHA256

c1bb46519446a732665bf0bff9bf3f0b64ee57b909e65019521e98f5d0b3e65b
SHA512

b4d9928b72b25fae0ea88637235c9a1b76a369a4cd7425731e5ae5494e7d91cd618486415a2f7b8385dc299bec9192265ad62176a329628aacf2a928654d413f
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhx:gExhk7rh7NEOIYWlPM6r6x

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2360	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2776	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2776	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2776	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2776	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2360	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2360	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2360	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2360	2400	e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1dd9f93d95a85af03b136f420884518_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
192KB

MD5
2f92b3b9515e5ccbf109a62ac3711700

SHA1
b0777910f100359a9f0b54ed9a2abfe57354501d

SHA256
1ea8247a5bcde3338a6b6fbb8ca443d2c3e5fe37037da73f0a219f8af6b79102

SHA512
57875e900838d22ca7dfa75e980c51a5d9de76e215b8b208a5c9c3486ae8b2abdc00c1f694892181ab3c5410c66c6e021481cca98e2047f005cde5249bfac95c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
9dc4e36dd7149d09376b8f702f95bee6

SHA1
8ad393e9f61ef8f62fb5b148e00e0d9cd60f7e9f

SHA256
75213e277d6d16f53281f48113f53506f25ad7f5fb72a50f657c2119c099b030

SHA512
225d4411e2ba0d91039824f1deb30b51a7c1d20fcc1ebb2c535c5377aecddfbffc5e74e53f5d2819e0bc8846d16dd63ca389fbf9d6bcd2a3d7832ea301e7ebf3

Download Submit
memory/2400-0-0x0000000001350000-0x0000000001384000-memory.dmp

Filesize
208KB

Download
memory/2400-16-0x00000000009A0000-0x00000000009D4000-memory.dmp

Filesize
208KB

Download
memory/2400-18-0x0000000001350000-0x0000000001384000-memory.dmp

Filesize
208KB

Download
memory/2776-17-0x0000000000BC0000-0x0000000000BF4000-memory.dmp

Filesize
208KB

Download
memory/2776-21-0x0000000000BC0000-0x0000000000BF4000-memory.dmp

Filesize
208KB

Download
memory/2776-22-0x0000000000BC0000-0x0000000000BF4000-memory.dmp

Filesize
208KB

Download