urelas | 886308422d89cb2ace24ba34833cdea1c4270f619c1061806d78f6748fbd0d5c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe
Size

782KB
MD5

ff186b26ca84dfa3b3b5640dee15eee2
SHA1

3ceedd19449602df733bf34e4ad3353fef5f1da8
SHA256

886308422d89cb2ace24ba34833cdea1c4270f619c1061806d78f6748fbd0d5c
SHA512

97723d675be9a0508d4f346c24a5110522540158bba3391686350f2c58ad83f87174574d1a0f7db20f1aea7e24a6320cab3d50332968bc0a4887171f6d87a915
SSDEEP

12288:YOlx4kk9HKda4YfM/1T3PPSnPI2VAWNDTJHq9DIMTW8c1+:YA4Ya1fQzPPSnPFqWtTJK9DIMTW8r

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wibiu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	wibiu.exe
4440	lokoe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wibiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lokoe.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe
4440	lokoe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4440	lokoe.exe
Token: SeIncBasePriorityPrivilege	4440	lokoe.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2716	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	83
PID 4352 wrote to memory of 2716	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	83
PID 4352 wrote to memory of 2716	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	83
PID 4352 wrote to memory of 4864	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	84
PID 4352 wrote to memory of 4864	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	84
PID 4352 wrote to memory of 4864	4352	ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe	84
PID 2716 wrote to memory of 4440	2716	wibiu.exe	102
PID 2716 wrote to memory of 4440	2716	wibiu.exe	102
PID 2716 wrote to memory of 4440	2716	wibiu.exe	102

C:\Users\Admin\AppData\Local\Temp\ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff186b26ca84dfa3b3b5640dee15eee2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\wibiu.exe
  "C:\Users\Admin\AppData\Local\Temp\wibiu.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\lokoe.exe
    "C:\Users\Admin\AppData\Local\Temp\lokoe.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

Filesize
304B

MD5
32c1937fa6d8dda6561faa532b342464

SHA1
01653f1085d3fe1abca174a8dbf2839e2b7ba799

SHA256
c815f289c7a61d687ce29157053709cbee8b8aa778f56bbe6a1d407ef836e0e7

SHA512
ea2587a79766ee1246d5e4bd6db2dcad267efd7fb9dec9a07ff0293d3581cb09254b8911713354c79d4edd35e76d167039d17997b0a10c791947abe0db73ec71

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
34e5f1256f81fd39f1f0620fb9111133

SHA1
d52bc76debbfa801f3e1772b198b6abf713f6882

SHA256
9615ccd6d9d821335003938aa63882e5cf3a3c07e074b399e6b3e53501513231

SHA512
8aef62790ece576058e856bb9887734131144d53451076deb0c789064211e2731d0df137651b7db15ad0c4be6eeee48b3f297465e1a4154103880b4d14e424d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\lokoe.exe

Filesize
156KB

MD5
8b3c6111c84733181c2cfff08e591f4f

SHA1
426d435b1f6673fbeaf6953c29d652d2e4e39a5e

SHA256
7a9fad27f5430a96faeabff354223e4a34b1afdbe95b4a030cdc371953e9e19a

SHA512
6dea9b868a378a9f12b94fc40b5fda06378581c419c413e33943be4d501695187dafec69c2d065c33d124d6adced6b3e22aede00f90869102309d57fe25231e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wibiu.exe

Filesize
782KB

MD5
5547f385a574a20bdfa0bd37176f7661

SHA1
e90dba659e31b8d13bddd7b94f9c2fc4bf9bef77

SHA256
3f3fc0465affb5245354bd8eeb3c051c2ca4d1aba26a394c6faafa5cec3795a7

SHA512
0e7c38f1c12287dda32c2a60a45d8cab8f0accac41312bdd364f142b1af894206b1e68241e0f8f4a6bceb715836900fec9f071c63f4ec0890f325a6c4cef33ca

Download Submit
memory/2716-27-0x0000000000500000-0x00000000005C9000-memory.dmp

Filesize
804KB

Download
memory/2716-12-0x0000000000500000-0x00000000005C9000-memory.dmp

Filesize
804KB

Download
memory/2716-17-0x0000000000500000-0x00000000005C9000-memory.dmp

Filesize
804KB

Download
memory/4352-14-0x0000000000310000-0x00000000003D9000-memory.dmp

Filesize
804KB

Download
memory/4352-0-0x0000000000310000-0x00000000003D9000-memory.dmp

Filesize
804KB

Download
memory/4440-25-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4440-28-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/4440-30-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4440-31-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4440-32-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4440-33-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/4440-34-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download