urelas | 9af5d8a13760a5b69ec7af7d7851de438c4ad903c08b1b6e0e4d272425a02c52

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe
Size

235KB
MD5

ea893657c3807e0b517ede8a64beeac4
SHA1

c5dabdc84044acb09983d783d884c643f04e8624
SHA256

9af5d8a13760a5b69ec7af7d7851de438c4ad903c08b1b6e0e4d272425a02c52
SHA512

46c141bb9de4ae7dac657d2697b0ae32f9cca66c67be5d938fe508502d9075f15bca4842e62e5aa3e7a53b4d5007bbbb1deb24c5d51c26ee1f94074ad127cbb1
SSDEEP

3072:K8ASpvo0LKrXEX65ezpxJ2kbJ7mv73E2o/9sY2P:ZASpvo0LKkRzpxJ2kRqroiP

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.207

112.175.88.208

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2704	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2676	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2676	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2676	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2676	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2676	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2704	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2704	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2704	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2704	2848	ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea893657c3807e0b517ede8a64beeac4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
7295fb9368a0ef278de4b9755bf9fa1b

SHA1
db5fa220d77ed7824ae0a4f822e0ce46010a5d77

SHA256
dd259fcdbf04aa773ede7515d6a83e5b112ed3d9eef4632cf856771bfeaafd98

SHA512
dd1a996311188c0baa54097fc7023f13e71115265fadb9dfa35f2a8d9df8aed1e37bd00ef612577d2eb63ba1b612a7b16a765ebfce3b7c9e7efebe54890eb88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
fdcfa57323458e07ae14138ff9dc99eb

SHA1
a070a25b8f8d672cf6dd0f8114b495d8cc458030

SHA256
929c2a63c15cd022d35f7444cb1ea714259d54d04394d9190c68f160e9737c81

SHA512
0a7a6b4069938e852b48bd36c805ebd8f805ade8362334ffc92519e9074d5d31538ff02255ec308158572b323d82f2a31edab2d75c8a6cafdf553173e2b3d032

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
235KB

MD5
65c18d303865571c75e61a5ba122c575

SHA1
6f6bbfaac5da5a49619574c9ab28a821600a0cab

SHA256
3f5316dcc8c16725edadd63df13b0a5bf3c60118b7de2d829d74eba4618b45d7

SHA512
f2e10b3e4f01d8c10a1ff9ad67cd34de603742c5d6fe54ce714a0c4cc5e9a1b8015aa1354bfc79257b8d31564163dc006120cd5ceff5cb2609f740ee1b0c5755

Download Submit
memory/2676-16-0x0000000000880000-0x00000000008BD000-memory.dmp

Filesize
244KB

Download
memory/2676-20-0x0000000000880000-0x00000000008BD000-memory.dmp

Filesize
244KB

Download
memory/2676-21-0x0000000000880000-0x00000000008BD000-memory.dmp

Filesize
244KB

Download
memory/2848-0-0x0000000000AC0000-0x0000000000AFD000-memory.dmp

Filesize
244KB

Download
memory/2848-17-0x0000000000AC0000-0x0000000000AFD000-memory.dmp

Filesize
244KB

Download