urelas | e7d9b3311972d7f5289c382e61d7411383cd5b26f69fe91f48616d7a0591b311

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/12/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe
Size

494KB
MD5

f65485d9c225e21dfad37fa199d9e93c
SHA1

807362f9b5765ba2a2ea4034bc0fd7a106e30ef9
SHA256

e7d9b3311972d7f5289c382e61d7411383cd5b26f69fe91f48616d7a0591b311
SHA512

825edbe3e55abfcb328ef90ea635153e893cfdd9da60cfdd97f00f87cad3dbad69d443e23ccb4a2e1245245c28152e6b7d8883feefff255e794557c76a39d403
SSDEEP

6144:KKLOgsgomKLEFESGz0SPpeEPkPDPrzgtRY5RdrHc13FG9ItU6GvPwm:/OgwmisETzuaeDPvjJ81VGqK6GvPr

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	xevyk.exe

Executes dropped EXE 2 IoCs

pid	Process
3412	xevyk.exe
1260	gaqic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xevyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaqic.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe
1260	gaqic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3412	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	83
PID 760 wrote to memory of 3412	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	83
PID 760 wrote to memory of 3412	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	83
PID 760 wrote to memory of 1196	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	84
PID 760 wrote to memory of 1196	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	84
PID 760 wrote to memory of 1196	760	f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe	84
PID 3412 wrote to memory of 1260	3412	xevyk.exe	91
PID 3412 wrote to memory of 1260	3412	xevyk.exe	91
PID 3412 wrote to memory of 1260	3412	xevyk.exe	91

C:\Users\Admin\AppData\Local\Temp\f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f65485d9c225e21dfad37fa199d9e93c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\xevyk.exe
  "C:\Users\Admin\AppData\Local\Temp\xevyk.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\gaqic.exe
    "C:\Users\Admin\AppData\Local\Temp\gaqic.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
feba46154e372f18fe5b940d47e0a3d2

SHA1
b4adb1be3839602c94e0f285134e6012b40692c2

SHA256
95c1fec940977224a7fec7a0a611ee0e250f4abe64e4fa6e19d109cb4e05e542

SHA512
8e2da48a9ece4abb8ab2ab19232ac03ff13bed1550f54b15ddcbe06b48ced6f904cf6eb04c9d444e815c2665b7677719f47044f801fe45000c83cba2e3248ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\gaqic.exe

Filesize
179KB

MD5
a39a3d221eb227ad9048d978d6b72a52

SHA1
544118d5386420156dc7852360d2d0ea2e6484d0

SHA256
da51f5bff4dba6c91876ecd39627efef1b91dae98d3a4d57aad6d35d81bd44f4

SHA512
814a8592f3a7365ea131bd80ec4aba3d9ee7c928b66e1c48c5942482e9b18adecff7c137e8a6c04f91aec0b44915124ee039ed5038fa15d68550007bba66f1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
1eca66520f2fffc909ed773dcbef5531

SHA1
250f5fe3ee77a0b6f5fad58257d0a2ef751633c2

SHA256
f63a0d3abbf9846335e34d3a1044f8a60aa1d8f87147e1dcb5b2d7afa6fab1e5

SHA512
ee6a1cd43316a866198f80f428650ce02b0be1265488dc60cad129566b443621c6e99361ad0980056be58623dcf457212bb76b4023701ddac8db63a832d39de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\xevyk.exe

Filesize
494KB

MD5
f3ce3cd95d6a5a6fa28f3460eb1b3a99

SHA1
28c964779c5c5fab7739043cfada5b45d29a8fa0

SHA256
af041449e98a44e7b9735dbeaa1a2dcb8a2eb4ae95dd7a665d1449efb348bc20

SHA512
715d14138d6470b431692b4eb63bfd1ef48fc503d2fc2ec5298ad7bf5809927cbdddcc9defc3aa055dd0f176be8b6ce849ad0c498f5e827399a1e3c64b4dafc7

Download Submit
memory/760-1-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/760-17-0x0000000000550000-0x0000000000589000-memory.dmp

Filesize
228KB

Download
memory/760-0-0x0000000000550000-0x0000000000589000-memory.dmp

Filesize
228KB

Download
memory/1260-47-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-46-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-45-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-43-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-38-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-44-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1260-42-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3412-20-0x0000000000120000-0x0000000000159000-memory.dmp

Filesize
228KB

Download
memory/3412-40-0x0000000000120000-0x0000000000159000-memory.dmp

Filesize
228KB

Download
memory/3412-21-0x0000000000D00000-0x0000000000D02000-memory.dmp

Filesize
8KB

Download
memory/3412-11-0x0000000000120000-0x0000000000159000-memory.dmp

Filesize
228KB

Download
memory/3412-14-0x0000000000D00000-0x0000000000D02000-memory.dmp

Filesize
8KB

Download