urelas | 0a31ea47101f9e6fe9cba61a5c6a921f2f2042af45d14aab5e1d81bd82cd750f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2024, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
Size

185KB
MD5

e84bb0d751edc4a666a61f5af8479a9b
SHA1

2eaba348142ec0e7d3d01edb87c7eb46b6977113
SHA256

0a31ea47101f9e6fe9cba61a5c6a921f2f2042af45d14aab5e1d81bd82cd750f
SHA512

18e70a583b490a1d5852b4d63ff5461621709be1849d9155e4a0db006b10add0094552dc5bcdf137a6fbad9105b2fbde9af195298556a3c861ddd9cb36285c57
SSDEEP

3072:u3mvqCDm+W03RB5eUp6UlD/mUKissApfA6y4YHFcg:2mvqeP33AYFIN9treHeg

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4144	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4144	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	83
PID 2956 wrote to memory of 4144	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	83
PID 2956 wrote to memory of 4144	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	83
PID 2956 wrote to memory of 4960	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	84
PID 2956 wrote to memory of 4960	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	84
PID 2956 wrote to memory of 4960	2956	e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e84bb0d751edc4a666a61f5af8479a9b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
185KB

MD5
763129916a627a31c2333440cdecab39

SHA1
5a0c048514ce8ce8cf73fd0e842f8f3791a69123

SHA256
02125caadae6275d9ce39cd5010f167a8d2526021fe4a948288993a293a808dd

SHA512
b94915dcb0ed6b3e4d74d5f1a20db3238a1d83eb5d1396f1d52d2346c5e05ecf3058f5556e78124816ed7e5e690b4c199952381341c255d4096d7541d8bab0d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1e75a7e32613b9d0b73f13b66c2c2f58

SHA1
035e2d6ab4ac34190f0e684681098188409e978c

SHA256
9f8aa6da5d4cd4a6f17fc229bb965d1f2525d6bc7f70ffba6a13c7e3bbd2a1f3

SHA512
e8ba9e9796b506655b9432ed7036383a3eab746a948a18df6e9598e59e6830a834e30bad7455bc22d4ae19a63f051d2aaa57b435594e881130559aac385bd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
2d20bf93df96670771a42c560e76c742

SHA1
21383068f59a0cefd1a907dfb283e1d280f1d807

SHA256
63ab2805b5a02eac996b6cb51d49ec9c77433f63da6941e845efb8c30a27955f

SHA512
6ce50b3fc178c9cf57c4342b3ce0bf8eb1914ea8e8b8118c8451361e67ce253432561ca1d1ecca4453e47fc9b678bfdc96ec431354b1ef04e90b7c91097ea240

Download Submit
memory/2956-0-0x00000000002D0000-0x0000000000302000-memory.dmp

Filesize
200KB

Download
memory/2956-17-0x00000000002D0000-0x0000000000302000-memory.dmp

Filesize
200KB

Download
memory/4144-15-0x0000000000920000-0x0000000000952000-memory.dmp

Filesize
200KB

Download
memory/4144-20-0x0000000000920000-0x0000000000952000-memory.dmp

Filesize
200KB

Download
memory/4144-21-0x0000000000920000-0x0000000000952000-memory.dmp

Filesize
200KB

Download