urelas | faf7883239a3d9b99ab7ce8fbfe4dc9047ebfed841ee5faf24f73e955c4dc64f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 534KB
Sample260415-sycdnaet2s
SHA256 faf7883239a3d9b99ab7ce8fbfe4dc9047ebfed841ee5faf24f73e955c4dc64f
MD5 1951bea7f9a28ec9a743367cf8108d11
SHA1 f9a1c85a96e57837c0165ac4cc60a0f1c6bc4ed1
SHA512 039d5f99777442713e0722e3f23c56c70bb90f08fe2ac42cffa28f8cca2ae961a6c96a51b5fc1828089ac4fc3ca040f0ea0560c016ea7916d29fe404e64ab831
SSDEEP 6144:FEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpLweWPnFQBaP5m:FMpASIcWYx2U6hAJQnvlGUPw
TLSH
T11DC4D01A76408672E3560771151AE6E16A296C3913E9D4CFF23C7D3E2A322D3537B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
1860	ulmyh.exe
4300	ficugi.exe
1100	elugc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulmyh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ficugi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elugc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe
1100	elugc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1860	4772	2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	80
PID 4772 wrote to memory of 2120	4772	2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	81
PID 1860 wrote to memory of 4300	1860	ulmyh.exe	83
PID 4300 wrote to memory of 1100	4300	ficugi.exe	84
PID 4300 wrote to memory of 5056	4300	ficugi.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1951bea7f9a28ec9a743367cf8108d11_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\ulmyh.exe
  "C:\Users\Admin\AppData\Local\Temp\ulmyh.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\ficugi.exe
    "C:\Users\Admin\AppData\Local\Temp\ficugi.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\elugc.exe
      "C:\Users\Admin\AppData\Local\Temp\elugc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 b4d53b08ca985db7acd19c17963ad23708ad2ff2bbf21122cd888f7f01c9a3a1
MD5 c831f134312850067573490b7f6faded
SHA1 a3b4d72fd14c33fb1d91fe5838fb1b7a06ec93ba
SHA512 9478e39ad1ed3d1d1c07d1df8522c1264c05a994ee9d1930782e26405c45e15948e3c0878e143eaad2020cee0015fad72523205c9faf6885ffa22be48e4f8809
TLSH
T1ABD0C71141D6D77F0458A02B06B5658DC0754C9C7F477B19DB22C44C31C541DF5D7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 0894b74cc007431dcd3e513a8e6bbe2616733cd17bc68c3dd49b489435ad1783
MD5 feafafb40162df5e7197698095ad0bfb
SHA1 c0f7fedc4064962c7b8dfdb2ffa1a35926d8419b
SHA512 ac15dad4d102892f06ccb457ab944a3933f2ee586195cd03153d6a408ad9a636a9fcf6d9fe97b28d46ea65943c65326f5b1239f09eee3033946131fc518dea14
TLSH
T119E0E50241DBED2A040CC00B06E9798E91F449582F873732A330C34C61D545DB0A2251
MD5 SHA1 SHA512 TLSH

Submit Download

elugc.exe

Path C:\Users\Admin\AppData\Local\Temp\elugc.exe
Size 223KB
SHA256 191cba471b25fe85519ec3337195e770f94f04aba6411b3cc497e0b5cf90c1a4
MD5 177c5a870369ef86cfaa21117dccf731
SHA1 1d6da9483ba0e219d5a6e6d889274c9958c158ce
SHA512 53d1077b1f434cb96c73774efed498f3d4e97c2134d38ed18593f5657056d7fc23de59328e2c535e91fbd22e33b2000c3c67dfb50c1ad179372c12031100ec2e
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3G:unFhSIkAyDgjtS/FZo
TLSH
T18F24E042AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ficugi.exe

Path C:\Users\Admin\AppData\Local\Temp\ficugi.exe
Size 534KB
SHA256 72fce55a7ff07f9068b82909a297e7af795a16eff248aaf5a586a694ff645e31
MD5 24f5b94bbbe38fe1017e315933175349
SHA1 2fb9e15e73657beb8ce00e8a2b0344e876bc322d
SHA512 0af343756f679ac81ed2434d7be2a70e87c2f99905ce2f05c088a9308df1766424ee140fc9a9e440e19eeb9814c9683b8fc42fa6b90e56e449a1ff16bae246b1
SSDEEP 6144:FEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpLweWPnFQBaP5e:FMpASIcWYx2U6hAJQnvlGUPY
TLSH
T13EC4C01A76408672E3560771151AE6E16A296C3913E9D4CFF23C7D3A2A322D3537B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 7100afbd8ca651175783f15e268f1cac3c266e8e672e8ebe6671ff711c8a3a15
MD5 e3a382f6e1d5f325e80ddb39d63dfd6b
SHA1 591cc6eb622e4d0a40a933dc053eac9ec56f7ecb
SHA512 27fe945825ce00c69265ece41fd8d38e8a5ccc16d073fcc6fa23f8ca4779d27ebd324707379a842f57b9991042f62184e0f4d6cd73a89633e21325dd94737690
TLSH
T1A7F08CD11062F0A43512E223F2A4338F1BA30C4827839D840104B070493992C8414280
MD5 SHA1 SHA512 TLSH

Submit Download

ulmyh.exe

Path C:\Users\Admin\AppData\Local\Temp\ulmyh.exe
Size 534KB
SHA256 d2475b64b813f6c161066e0c5c3a20b93af7559685f388b7b6e9de6bd08da469
MD5 6c1b29bbc52e5214c8f3d88fc63eaf90
SHA1 a548e82bd6fb62b4f7f7dde39c465229a9f007b5
SHA512 f834f690d6a30497891b437a761b8d6170e41495f9a384557a5681284d9c287abe8fd22fca9d70ebe3d544130ac5ce6533b96060e95d23fb0136bd75f0bd4027
SSDEEP 6144:FEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpLweWPnFQBaP5H:FMpASIcWYx2U6hAJQnvlGUP9
TLSH
T1FAC4D01A76408672E3560771151AE6E16A296C3913E9D4CFF23C7D3E2A322D3537B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-55-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1100-56-0x0000000003BD0000-0x0000000003CAA000-memory.dmp

Download

memory/1100-63-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1100-61-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1100-59-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1100-49-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1100-57-0x00000000006A0000-0x0000000000740000-memory.dmp

Download

memory/1860-26-0x0000000002280000-0x000000000235A000-memory.dmp

Download

memory/1860-27-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1860-14-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4300-29-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4300-52-0x0000000002260000-0x000000000233A000-memory.dmp

Download

memory/4300-53-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4300-30-0x0000000002260000-0x000000000233A000-memory.dmp

Download

memory/4300-28-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4772-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4772-17-0x0000000000400000-0x0000000000479000-memory.dmp

Download