urelas | dff075ce864c6b1fb6d5ed1b45a5d56ae27533bde90042c04a78161153d1d059

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe
Size

208KB
MD5

fca69f290ab255b94973bd988ec85643
SHA1

bb9ec64a5c10cc52bab67263e4ffbfe1187faced
SHA256

dff075ce864c6b1fb6d5ed1b45a5d56ae27533bde90042c04a78161153d1d059
SHA512

c4f306f0e9060068dd07c8dcdd439a4417a8bf08f953cefbd25545ab852c12d20905a34cbbbfd9cd2615c15a03ab90b0b5dfa0128c7dcee1118217219fc8e1c6
SSDEEP

1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rcR6:PuchogM57bIL+eb61TVa+3MJb6/

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

112.175.88.208

112.175.88.209

112.175.88.207

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3736	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	82
PID 2808 wrote to memory of 3736	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	82
PID 2808 wrote to memory of 3736	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	82
PID 2808 wrote to memory of 5084	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	83
PID 2808 wrote to memory of 5084	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	83
PID 2808 wrote to memory of 5084	2808	fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fca69f290ab255b94973bd988ec85643_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
02167b944a214fee3d34f9a7e356dc6a

SHA1
ca5b3f38a7151268726401593eb35f9b67bdde97

SHA256
77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

SHA512
c8976c66724d737105a66699673052d7bc7f1e1941c91e03f97452aaba714d35b1d55434e950b00c58626b8bcf16186a731cccc503b7ba08f080ead3eaca5817

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
208KB

MD5
8ca09412061fadf94dc001819b467b1c

SHA1
912dfb5a3dcb0f18a1821f7c1ac336009abf2af6

SHA256
68fd95ba38c81c3f7fe232f4d70f6d4f4329ef41877a38a33502125ba2f4ac1a

SHA512
fd017c3ee01baa9be8c611d4305c0b6a3a762510aea8347ca9be1291f2769f42e899bca67157baa0250968326d0a50f9fbad9bf0f6e7f4930c5699e60a567dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
302B

MD5
29f8676541d2ae919e855f3e7ef12997

SHA1
6e4c3d809e48ba07307ca21b7470c01656784f71

SHA256
73d45ae11f000d2bc327de18a8fb2cba36eeb6fce85dae99d4c67bc5505f2ff6

SHA512
406fc8494c3543cb976e9a07f612bbd65b1c94ef384972dde806279cad8b162089f3b79c69e9ec463f2e9937086a3da92ae54060b83286ad3a97ae55719357a0

Download Submit
memory/2808-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2808-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3736-19-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3736-20-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download