urelas | 51222024437716b24584db95771ed055de84d2fe15e024548fecb8b9763a4ffb

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe
Size 1.8MB
Sample260418-ml58bacy6k
SHA256 51222024437716b24584db95771ed055de84d2fe15e024548fecb8b9763a4ffb
MD5 3d5691ed6eb2089cf9bcdd505d5f748a
SHA1 a13d8028c8600fb542f580a3c84796e0e296ec05
SHA512 207f9fddc4b88814887a65b99548a7e39f43e56376be96dcae7cd471ade4f4af88744ceee329cbf3b6de5ccf1326f67d03cbc6754cd5269d28121717581efc2c
SSDEEP 49152:DS7xdZn4KLE1SBixSQWTX9yOK9bnJSEZaSHiJxooSjRiENpX4DjIlq:Yxz4KLTBMWTX9yOK9bnJNZSxoo+iENpI
TLSH
T14785AE3A7651903AD6733631510AE7B8F2AEED304975055BA6A13F3D2E304838E2D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe

Executes dropped EXE 1 IoCs

pid	Process
1100	kutie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	1100	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kutie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1100	4616	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe	86
PID 4616 wrote to memory of 5604	4616	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\kutie.exe
  "C:\Users\Admin\AppData\Local\Temp\kutie.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 584
    3⤵
    - Program crash
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 1100
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 352B
SHA256 821cbf8c67d32bcf5d92b20ad8491157d9bff977321d4234a6dcd0abe1a1b475
MD5 abe6f2879b1c05cc7e56ffbd01d3a072
SHA1 0386d1a04fc53ea80c17dd8f3b5b93fd1fddac76
SHA512 a9d84b81a73b3be266a8d8c9ff65e2d03294cefa9798337a41770f17454a7aa9891d1e4d6d5984ee320c677229cd48c09406f708f320aa96616492fd7bf00689
TLSH
T1C0E04F1240FFCE5A4554B03747B22A8CC1A95ADE2B4B3B13E734D90E21C355EB6E7A01
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 31b4b3a9b2bd6b09d50de50c890d0da6a87906e6e722431f1bce6849c5555a42
MD5 3f1831fed3adf805b34b31f78bd4ef07
SHA1 bf5bd83aec89e1ab9743934603a9e6d1dac0dbbd
SHA512 87a784a447bed8ef27d1c88c623cb5d26b6d836c3a669a64eef451cb67f39259d1ccd154d4c1c4152f4f1b0fc13dfcdd8dbfc326090b30945f4d8796caa5fb1e
TLSH
T1EDF04CE92561A0163013F612E2486B99AB974D9D16C74DDC0105F2715D74D6C4449561
MD5 SHA1 SHA512 TLSH

Submit Download

kutie.exe

Path C:\Users\Admin\AppData\Local\Temp\kutie.exe
Size 1.8MB
SHA256 7ea11682bf6ebcb73fbba6c7cdf05a357d7dccb6d61386b1468e1a69e0af3ed2
MD5 e3a73ae610512cff4b8d8967c913b90a
SHA1 87f20920466e7d2dab7772d06a1e4d1afdb2eb13
SHA512 b88d13cb88bda176cd2b6955f2ec3b51c9af2585f3d10be5213d3017e7eb553f1290631c565be0e4a994facfc2e86ce9128e799281ee196278fd63dfc668487a
SSDEEP 49152:DS7xdZn4KLE1SBixSQWTX9yOK9bnJSEZaSHiJxooSjRiENpX4DjIlx:Yxz4KLTBMWTX9yOK9bnJNZSxoo+iENpj
TLSH
T12085AE3A7651903AD6733631510AE7B8F2AEED304975055BA6A13F3D2E304838E2D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-12-0x0000000000C00000-0x0000000000DD6000-memory.dmp

Download

memory/1100-16-0x0000000000C00000-0x0000000000DD6000-memory.dmp

Download

memory/1100-19-0x0000000000C00000-0x0000000000DD6000-memory.dmp

Download

memory/4616-0-0x0000000000CE0000-0x0000000000EB6000-memory.dmp

Download

memory/4616-1-0x0000000000DFD000-0x0000000000DFE000-memory.dmp

Download

memory/4616-15-0x0000000000CE0000-0x0000000000EB6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads