urelas | 2418bb807ba9457b1f36ac74fa95f2db56bcf604ecc922e70f4f3655eff35965

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe
Size

333KB
MD5

83fb15afc9b12b44e93da3654fb427a1
SHA1

20061063f88649a8ef2a3bdf56582a49f3847cba
SHA256

2418bb807ba9457b1f36ac74fa95f2db56bcf604ecc922e70f4f3655eff35965
SHA512

cdd9d08ff6b0688504d2a064f7705e5133c6126edb53d40d066da98d640b5bbbc4b822983818b68fa359ac31005ce1a823698c6c10bae19c3538e93e1bba8937
SSDEEP

3072:NdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisX:Nd7rpL43btmQ58Z27zw39gY2FeZhmzc

Score

10^/10

urelas aspackv2 discovery trojan

Malware Config

Extracted

Family

urelas

218.54.31.165

218.54.31.226

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000d000000024061-31.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	golyok.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	jisyh.exe

Executes dropped EXE 3 IoCs

pid	Process
1860	jisyh.exe
4388	golyok.exe
5156	pudug.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pudug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jisyh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golyok.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe
5156	pudug.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1860	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	85
PID 3896 wrote to memory of 1860	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	85
PID 3896 wrote to memory of 1860	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	85
PID 3896 wrote to memory of 1156	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	86
PID 3896 wrote to memory of 1156	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	86
PID 3896 wrote to memory of 1156	3896	2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe	86
PID 1860 wrote to memory of 4388	1860	jisyh.exe	88
PID 1860 wrote to memory of 4388	1860	jisyh.exe	88
PID 1860 wrote to memory of 4388	1860	jisyh.exe	88
PID 4388 wrote to memory of 5156	4388	golyok.exe	110
PID 4388 wrote to memory of 5156	4388	golyok.exe	110
PID 4388 wrote to memory of 5156	4388	golyok.exe	110
PID 4388 wrote to memory of 1344	4388	golyok.exe	111
PID 4388 wrote to memory of 1344	4388	golyok.exe	111
PID 4388 wrote to memory of 1344	4388	golyok.exe	111

C:\Users\Admin\AppData\Local\Temp\2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_83fb15afc9b12b44e93da3654fb427a1_amadey_rhadamanthys_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\jisyh.exe
  "C:\Users\Admin\AppData\Local\Temp\jisyh.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\golyok.exe
    "C:\Users\Admin\AppData\Local\Temp\golyok.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\pudug.exe
      "C:\Users\Admin\AppData\Local\Temp\pudug.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_vslite.bat

Filesize
364B

MD5
f86312cd2375e47d58c77d9362b11a51

SHA1
53567a3728f2c57c4808ce29824f8d818c843ef3

SHA256
b4ca9c15204d5b1795be055448ceec1dba607752948593d7b05aebce3a6f8e9b

SHA512
e555004f16c6427a41ebb89250bca86b4c322a454ca0c00456a071a960c5434efceecdf9506720f0b1953224a9643dae0b63a79c4124146803ef6b6108664baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_vslite.bat

Filesize
224B

MD5
09cec2b3db7d1a50c0d1dc83e2b16bfb

SHA1
8802acaa60ac2b4de98278b09d329008d2bf6d35

SHA256
09394a76390fc67b9e5869547b4c19ed559fd15a46bf3f7f21fab4a1c4b18bed

SHA512
593845b93d86e697325abeaaf9fc518a50a4c5f6ba38c00115cb24754097926123671aff31ca2ca1470c65c07ded4318e0752e26f07caf5ed53fbea83c968a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
f4c0f1dddf01a34bdb04fa6f095f00f2

SHA1
680655d0d1768561ae5e21b2c2d157c831ad286f

SHA256
7dba26f41cf6829757ad529acea8c8777845f9ae9235782c2b963aacd689a763

SHA512
56a446f1c9c6e9ff5c02aca2dd8ca00656e6282d11aae2939e185775ffcf520901a601dbdcba53079fe515622a5fd6ca9f6eba40e66851051f62221ef9a4a219

Download Submit
C:\Users\Admin\AppData\Local\Temp\jisyh.exe

Filesize
333KB

MD5
db9bca1a47d8448716c8aa57799f1936

SHA1
c449050237cc34697f6a474c7a4f006fdd092fc8

SHA256
6b44ae406b93f0b0cba0443090d42c9b33775f5b8928ffc35f827504d79a9c8e

SHA512
71842d16d615641f04c7de53d56e1f78df61f0c436b51c13211619ec777d01bfba46afd44ee54b881dc4ae1a0e973fcd7a37a667a32d9002eb314f2a25789dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\pudug.exe

Filesize
136KB

MD5
b9ad7bd7891cb5a18a8378fe38fb4ec6

SHA1
e3c2b86e0ad071b4756bf8d20b86dc1a088df1d3

SHA256
1e82b06b9443c98806c8652ed14f38459b5b5b0caa7b05eefd9daa3dd14dd08f

SHA512
b4ab7f065684835a8ad8672785aed19803a1f82dd692eb07b70b8a65b38d7a9245f6e216c84c57a66ad18c7a195642af4298377f48a783900c003ed4ad46f397

Download Submit
memory/1860-24-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3896-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3896-15-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4388-42-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4388-25-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5156-40-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-36-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-39-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-38-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-44-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-45-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-46-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-47-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-48-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download
memory/5156-49-0x0000000000450000-0x00000000004DC000-memory.dmp

Filesize
560KB

Download