urelas | dff075ce864c6b1fb6d5ed1b45a5d56ae27533bde90042c04a78161153d1d059

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe
Size

208KB
MD5

fca69f290ab255b94973bd988ec85643
SHA1

bb9ec64a5c10cc52bab67263e4ffbfe1187faced
SHA256

dff075ce864c6b1fb6d5ed1b45a5d56ae27533bde90042c04a78161153d1d059
SHA512

c4f306f0e9060068dd07c8dcdd439a4417a8bf08f953cefbd25545ab852c12d20905a34cbbbfd9cd2615c15a03ab90b0b5dfa0128c7dcee1118217219fc8e1c6
SSDEEP

1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcR6:PuchogM57bIL+eb61TVa+3MJb6/

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Deletes itself 1 IoCs

pid	Process
2920	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	huter.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2796	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2796	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2796	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2796	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2920	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2920	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2920	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2920	2212	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
02167b944a214fee3d34f9a7e356dc6a

SHA1
ca5b3f38a7151268726401593eb35f9b67bdde97

SHA256
77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

SHA512
c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
29f8676541d2ae919e855f3e7ef12997

SHA1
6e4c3d809e48ba07307ca21b7470c01656784f71

SHA256
73d45ae11f000d2bc327de18a8fb2cba36eeb6fce85dae99d4c67bc5505f2ff6

SHA512
406fc8494c3543cb976e9a07f612bbd65b1c94ef384972dde806279cad8b162089f3b79c69e9ec463f2e9937086a3da92ae54060b83286ad3a97ae55719357a0

Download Submit
\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
208KB

MD5
aa1d41cd7f5a15ebe4b127ae24d918fd

SHA1
7dcf66032cc4d5c8c932d2a4867f588343c28b84

SHA256
aef876723756e469c94c57aa520c9e491ebe53e9520b673299fee93923f44806

SHA512
f4dd2c73972e8681b032ba2674b1b364a81d461c12d7502587bc644d3a96e7aeb814f7026051afd70858a841adf64899643846095839c0952cde54f84ea22a71

Download Submit
memory/2212-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2212-17-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2212-16-0x00000000020F0000-0x0000000002127000-memory.dmp

Filesize
220KB

Download
memory/2796-18-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2796-21-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2796-22-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download