urelas | 0a31ea47101f9e6fe9cba61a5c6a921f2f2042af45d14aab5e1d81bd82cd750f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
Size

185KB
MD5

e84bb0d751edc4a666a61f5af8479a9b
SHA1

2eaba348142ec0e7d3d01edb87c7eb46b6977113
SHA256

0a31ea47101f9e6fe9cba61a5c6a921f2f2042af45d14aab5e1d81bd82cd750f
SHA512

18e70a583b490a1d5852b4d63ff5461621709be1849d9155e4a0db006b10add0094552dc5bcdf137a6fbad9105b2fbde9af195298556a3c861ddd9cb36285c57
SSDEEP

3072:u3mvqCDm+W03RB5eUp6UlD/mUKissApfA6y4YHFcg:2mvqeP33AYFIN9treHeg

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2392	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	biudfw.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2664	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	30
PID 1968 wrote to memory of 2664	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	30
PID 1968 wrote to memory of 2664	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	30
PID 1968 wrote to memory of 2664	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	30
PID 1968 wrote to memory of 2392	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2392	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2392	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	31
PID 1968 wrote to memory of 2392	1968	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
2d20bf93df96670771a42c560e76c742

SHA1
21383068f59a0cefd1a907dfb283e1d280f1d807

SHA256
63ab2805b5a02eac996b6cb51d49ec9c77433f63da6941e845efb8c30a27955f

SHA512
6ce50b3fc178c9cf57c4342b3ce0bf8eb1914ea8e8b8118c8451361e67ce253432561ca1d1ecca4453e47fc9b678bfdc96ec431354b1ef04e90b7c91097ea240

Download Submit
\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
185KB

MD5
1004582aa0cfc4644ef44d3a62ecb8eb

SHA1
a2183c39279a7d34a0916cbe845996ffe1c7a9bb

SHA256
31f3882ba3aebcb7cf6de4ccaaab3e13c548265caceba40b8ce4a2a93d36c60c

SHA512
0d4fa75d38a2283f92c0d23549046d9769de1f31fc2981993cdae267dabe2c7c275b458ff2143556a4ca2c2689ade62298a33eacf3d4c03345907215b2732461

Download Submit
memory/1968-0-0x0000000000180000-0x00000000001B2000-memory.dmp

Filesize
200KB

Download
memory/1968-8-0x0000000001DD0000-0x0000000001E02000-memory.dmp

Filesize
200KB

Download
memory/1968-18-0x0000000000180000-0x00000000001B2000-memory.dmp

Filesize
200KB

Download
memory/2664-16-0x0000000001020000-0x0000000001052000-memory.dmp

Filesize
200KB

Download
memory/2664-21-0x0000000001020000-0x0000000001052000-memory.dmp

Filesize
200KB

Download
memory/2664-22-0x0000000001020000-0x0000000001052000-memory.dmp

Filesize
200KB

Download