urelas | 70f36ffdb6cd8f8af66288e1cd9a3d097b5bb0db4b8a0a3e4ff7f1b9fcdd1344

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe
Size

400KB
MD5

6784de327530a5fd162a370a4c500af3
SHA1

331b6c1c41e2fcdf3d257af94ea6f71878ee5abd
SHA256

70f36ffdb6cd8f8af66288e1cd9a3d097b5bb0db4b8a0a3e4ff7f1b9fcdd1344
SHA512

fed12a9ec011964a6df5495e1380f38ee547e3da8eb22da18a996a4e7a95d4d51bd4c2c29410d79be87d930f92ec148826f67b1c8660808c9ad20d33d7fbc05f
SSDEEP

6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohh:8IfBoDWoyFblU6hAJQnOr

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165

218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	pykiz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	fugisy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe

Executes dropped EXE 3 IoCs

pid	Process
5872	pykiz.exe
1252	fugisy.exe
5996	tyeqf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pykiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fugisy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tyeqf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe
5996	tyeqf.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5756 wrote to memory of 5872	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5756 wrote to memory of 5872	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5756 wrote to memory of 5872	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	85
PID 5756 wrote to memory of 2964	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	86
PID 5756 wrote to memory of 2964	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	86
PID 5756 wrote to memory of 2964	5756	2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe	86
PID 5872 wrote to memory of 1252	5872	pykiz.exe	88
PID 5872 wrote to memory of 1252	5872	pykiz.exe	88
PID 5872 wrote to memory of 1252	5872	pykiz.exe	88
PID 1252 wrote to memory of 5996	1252	fugisy.exe	109
PID 1252 wrote to memory of 5996	1252	fugisy.exe	109
PID 1252 wrote to memory of 5996	1252	fugisy.exe	109
PID 1252 wrote to memory of 4272	1252	fugisy.exe	110
PID 1252 wrote to memory of 4272	1252	fugisy.exe	110
PID 1252 wrote to memory of 4272	1252	fugisy.exe	110

C:\Users\Admin\AppData\Local\Temp\2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-02_6784de327530a5fd162a370a4c500af3_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Users\Admin\AppData\Local\Temp\pykiz.exe
  "C:\Users\Admin\AppData\Local\Temp\pykiz.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Users\Admin\AppData\Local\Temp\fugisy.exe
    "C:\Users\Admin\AppData\Local\Temp\fugisy.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\tyeqf.exe
      "C:\Users\Admin\AppData\Local\Temp\tyeqf.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

Filesize
364B

MD5
f60ebff18364d32487711503e377633c

SHA1
0fef1454d728754fee1d2023adb94050d30434be

SHA256
e07ac9c9eaf1087884b7d144996df399e2e19c59b711bcbe614bddcc543f76cf

SHA512
fc8460fd4cc721516437966ed4b4a3b2702970680994257aa778f12239acfd597250c1b45c1c5a302fb601420079a9e007f445cc95307681eac5b5d30e26fdb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_vslite.bat

Filesize
224B

MD5
a30120dd39d24ebefd4deb507bd26f93

SHA1
38afcd06c9530f9efec5b05b39e60d2995fc63b5

SHA256
623408f287641cb7bc51ad82671d2121a61b39067103588199a41ff5b0f55d97

SHA512
a6b03c86818d73a4242ebb0c76561b29d4e6348ac890732c40a1c33c954aef41e93340bddda3c6680e667aa2c039ecaa2065ce1b2a65340d66c5c3f5f06d2070

Download Submit
C:\Users\Admin\AppData\Local\Temp\fugisy.exe

Filesize
400KB

MD5
859c5abebc7ecd1f591a1961b264d81a

SHA1
e0be7c53e024a2185573976754a219de3cdf5a05

SHA256
679c777640781b13d0bd49de0f7c8e48ce215ef0961e4254b684bd5147f44aac

SHA512
93c06906c80d8703f79828f6cc8bc2718d2c72b91bb18966482bae41ddb6e844e3b7d852f4a83311f7f749f0a9d928171ade93e75b24decc91eb7f5d9b567445

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
73a693aa57f4e0bf5d87c658efee43b6

SHA1
f7b30929308852a5cc47189641e8e35535eb1d82

SHA256
613837fcd2bb377ab6e240eaba6f5bce8c87607fe0011e1720ac3021f48eb57d

SHA512
eb6b070bcb56d25ef40ac123de995040f76e581cc748e8597aeb28a4e8dafd92cac3d8698df68eac1baf6119dbb89a58339ea4d0a59d3ab7a467650a5264b0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\pykiz.exe

Filesize
400KB

MD5
42d24c006acb1f524fd2b441b199d60b

SHA1
1c372b1074c0754b597be4aa2f08a573b44151c7

SHA256
e26dd3810a4637eaded3863c9f37a021da357677e7cffc530ef8531363cba387

SHA512
d0cfe54682cb7cf09969a9f4f4bc7343f8902ea7cd7024d47403d84db6ab71d5b1009e5f7bb88d5ba11d36a90f897abefbd71cdae10e969accbb99dc6b1388aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tyeqf.exe

Filesize
223KB

MD5
49001570a2d1d968f1d6fa7c65c046d2

SHA1
cee49d79057d4f0f32055ed3bbb9bc75b4f4f902

SHA256
6dfcefa6ddbefad7ae49937d5cbb60a62b61ab11f48eb035e4601019453cf789

SHA512
dac11ab9002313d26bca4a88a12cc2d35496331da3969d815dc5c122cbc5c59363c1710b57d0650882050a04f0758b9cf82fedad913b001b3a178ec9bf4a0810

Download Submit
memory/1252-26-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/1252-39-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/5756-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/5756-16-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/5872-25-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/5872-12-0x0000000000400000-0x00000000004679C5-memory.dmp

Filesize
414KB

Download
memory/5996-37-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/5996-42-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/5996-43-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/5996-44-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/5996-45-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download
memory/5996-46-0x0000000000B70000-0x0000000000C10000-memory.dmp

Filesize
640KB

Download