urelas | 10945d08099905059ad91a8c82998af7d5765f4bb7d2d0cb294fee7c3c668755

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe
Size

557KB
MD5

f830a675b54b456f32bdcd7a4e6bbe76
SHA1

b697688bf854b921810f9bd0eb41004691427ef4
SHA256

10945d08099905059ad91a8c82998af7d5765f4bb7d2d0cb294fee7c3c668755
SHA512

9cd2e8fe6ecef0e9aa0f60408ec163c1fe88630aa377ea2b893f7b7f258d02ac0bb06e428d39b7f8221edd77751488c5874f7baba1b729efe10f63f5d0a09e8d
SSDEEP

12288:zccNvdRExZGe+Q1nSoS++43x+l7QLiaEyZ:znPfQp9L3olqFZ

Score

10^/10

urelas discovery trojan upx

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	bodod.exe

Executes dropped EXE 2 IoCs

pid	Process
4772	bodod.exe
4376	iwsiz.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3652-0-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/files/0x000b000000023b8f-6.dat	upx
behavioral2/memory/3652-13-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4772-16-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4772-26-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bodod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iwsiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe
4376	iwsiz.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4772	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	83
PID 3652 wrote to memory of 4772	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	83
PID 3652 wrote to memory of 4772	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	83
PID 3652 wrote to memory of 4660	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	84
PID 3652 wrote to memory of 4660	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	84
PID 3652 wrote to memory of 4660	3652	f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe	84
PID 4772 wrote to memory of 4376	4772	bodod.exe	103
PID 4772 wrote to memory of 4376	4772	bodod.exe	103
PID 4772 wrote to memory of 4376	4772	bodod.exe	103

C:\Users\Admin\AppData\Local\Temp\f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f830a675b54b456f32bdcd7a4e6bbe76_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\bodod.exe
  "C:\Users\Admin\AppData\Local\Temp\bodod.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\iwsiz.exe
    "C:\Users\Admin\AppData\Local\Temp\iwsiz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
5a9e9a533d431559f56532094253eb5c

SHA1
3f26e4747c2ce9dd76db98176e5e35a702892a2d

SHA256
4f5f1c77cfb5b30923998732bd9d878444115879f0c64e9bd3b0535987a08825

SHA512
09a223f3da83319b380968abfd6032c49c36f6009d3e04b6095b1964a35fd58d4ccd85b14778256440430c651196c471cbc454a11f7e749b1d9d241111cf48f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bodod.exe

Filesize
557KB

MD5
587edb6978b3300f0b9fad2b1cf1bbfa

SHA1
da3dbc5147c0fb901a4a63c3c85231fac8b5e369

SHA256
167b57494c732d416874bfaa7b1b17d0556131e6844e34f3b856e10a5e4f03c1

SHA512
ce26c10d5f9e9204e06d26e3c62f929c236e2b221bae3829db9ec6f9a5d4094a29974dba444a3ab9e64c2c7df131ccb227df8725ff625c2a0abde340f416c103

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
e6303b1445aef88703ea175541d7d09f

SHA1
0ab76558f04f8c6a467e93c818bd9f757af2889e

SHA256
669c41015e209846e45a8230c87c9d8b4d1d47622a25ab28b899ce7f34f33c88

SHA512
a49d581c214fb317ef3f3d4ed97010fd4e25b8f3f8354382b4515ac7252e32f370a563e24199c14d566e3090f677818de03e6ba572c5e9337a7a50249a56b45c

Download Submit
C:\Users\Admin\AppData\Local\Temp\iwsiz.exe

Filesize
194KB

MD5
364fdf04460e46d07db587480ea7e841

SHA1
83971e297697744d8967932a31adcae3845734ad

SHA256
d62ad83015ab5069c95728ccf3aaac48b4bff3f8de063e1491f01191ef0be824

SHA512
f38f4391d04e2a5328a9da7bf3d1b88e3f7263cadf41daeeaf9899281a8dc6eae23b04b9eb30d3778838fc45ca765a859e8bd94655183e9ab3edc319dccebbd2

Download Submit
memory/3652-13-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3652-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4376-24-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-27-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/4376-29-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-30-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-31-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-32-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4376-33-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4772-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4772-26-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download