urelas | 51222024437716b24584db95771ed055de84d2fe15e024548fecb8b9763a4ffb

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe
Size 1.8MB
Sample260418-ml58bacy6k
SHA256 51222024437716b24584db95771ed055de84d2fe15e024548fecb8b9763a4ffb
MD5 3d5691ed6eb2089cf9bcdd505d5f748a
SHA1 a13d8028c8600fb542f580a3c84796e0e296ec05
SHA512 207f9fddc4b88814887a65b99548a7e39f43e56376be96dcae7cd471ade4f4af88744ceee329cbf3b6de5ccf1326f67d03cbc6754cd5269d28121717581efc2c
SSDEEP 49152:DS7xdZn4KLE1SBixSQWTX9yOK9bnJSEZaSHiJxooSjRiENpX4DjIlq:Yxz4KLTBMWTX9yOK9bnJNZSxoo+iENpI
TLSH
T14785AE3A7651903AD6733631510AE7B8F2AEED304975055BA6A13F3D2E304838E2D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3028	kajyb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1040	3028	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kajyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 3028	784	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe	80
PID 784 wrote to memory of 3704	784	2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3d5691ed6eb2089cf9bcdd505d5f748a_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\kajyb.exe
  "C:\Users\Admin\AppData\Local\Temp\kajyb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 644
    3⤵
    - Program crash
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3028 -ip 3028
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 352B
SHA256 821cbf8c67d32bcf5d92b20ad8491157d9bff977321d4234a6dcd0abe1a1b475
MD5 abe6f2879b1c05cc7e56ffbd01d3a072
SHA1 0386d1a04fc53ea80c17dd8f3b5b93fd1fddac76
SHA512 a9d84b81a73b3be266a8d8c9ff65e2d03294cefa9798337a41770f17454a7aa9891d1e4d6d5984ee320c677229cd48c09406f708f320aa96616492fd7bf00689
TLSH
T1C0E04F1240FFCE5A4554B03747B22A8CC1A95ADE2B4B3B13E734D90E21C355EB6E7A01
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1efd1c0f3d42d7585c35806040a006605f80b1360ff95888743125a16ee6bb1c
MD5 7738102efb3783a47f698eabbcde78a6
SHA1 337de05f2a331a7d7c1fbe60b12f20a706231459
SHA512 dac70f690a3be9512a254fb100cc90c60ee1f9c8d3e3d4faf841be608090b9aa7561c2718c37b2d24a37caeb3dcf232b2f9117fe73b29aff81b81bcc0ad8aa3e
TLSH
T134F04C9521A1A0653217E512D69877A677674DAC4BC34D940405B2708D76E5C4809250
MD5 SHA1 SHA512 TLSH

Submit Download

kajyb.exe

Path C:\Users\Admin\AppData\Local\Temp\kajyb.exe
Size 1.8MB
SHA256 d0be6802e25a03d06ea4cc544f6a219657ab128b03ea048867ce95cb8c8d308b
MD5 6c1f5d9fa69a8a59450d3b1bf15e22f7
SHA1 82e4050c4dea01b08cc2d003943fb6a58171a648
SHA512 8eb33ed5a4463120b5b91b7f4c25c75eff878b6627ceeed6aea19db0ca83908db5bd0bdb80f3f88a92497152fa6e45dfac50f4234182cd67a0a5f337a9cfe513
SSDEEP 49152:DS7xdZn4KLE1SBixSQWTX9yOK9bnJSEZaSHiJxooSjRiENpX4DjIlK:Yxz4KLTBMWTX9yOK9bnJNZSxoo+iENpo
TLSH
T1B585AE3A7651903AD6733631510AE7B8F2AEED304975055BA6A13F3D2E304838E2D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-0-0x00000000001B0000-0x0000000000386000-memory.dmp

Download

memory/784-1-0x00000000002CD000-0x00000000002CE000-memory.dmp

Download

memory/784-16-0x00000000001B0000-0x0000000000386000-memory.dmp

Download

memory/3028-14-0x000000000039D000-0x000000000039E000-memory.dmp

Download

memory/3028-13-0x0000000000280000-0x0000000000456000-memory.dmp

Download

memory/3028-19-0x0000000000280000-0x0000000000456000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads