urelas | 251fd8c0c8d401a8a877ced19a84792bd2a53a353f473e5115cc09f0a637e48f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 423KB
Sample260421-3d95ashs8w
SHA256 251fd8c0c8d401a8a877ced19a84792bd2a53a353f473e5115cc09f0a637e48f
MD5 b19d3765ad9c5c2c9c30363b651df09e
SHA1 d6823c9b95de8de3d218ccb6ca1a918c365f08ae
SHA512 8542953540e4e6b85c1ff9e353238a74835e73c9f513a24d0afb4dd7a5c9850d470b26d74fa127b94b1ef2c5f6ef112b0e692ac9c6193765467887f8b5d8b0cf
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iWpC:yIfBoDWoyFboU6hAJQnrMBC
TLSH
T18694BE253240C436F32A0B364456FAA04A65BC3A15D5E48FF7787E7A5D312938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4156	helab.exe
960	nuqito.exe
1052	jilib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jilib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuqito.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe
1052	jilib.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4156	3240	2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	80
PID 3240 wrote to memory of 3948	3240	2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	81
PID 4156 wrote to memory of 960	4156	helab.exe	83
PID 960 wrote to memory of 1052	960	nuqito.exe	84
PID 960 wrote to memory of 3924	960	nuqito.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_b19d3765ad9c5c2c9c30363b651df09e_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\helab.exe
  "C:\Users\Admin\AppData\Local\Temp\helab.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\nuqito.exe
    "C:\Users\Admin\AppData\Local\Temp\nuqito.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\jilib.exe
      "C:\Users\Admin\AppData\Local\Temp\jilib.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 284092a8e999ebf9a0064480a5d580f85524fe772a07d29f9c004721e29abb53
MD5 d84032798ac244b8c9ae03d57eb707f2
SHA1 fafdd1ba4ad3170988130c41d9436eb9430cbfca
SHA512 734211dc96ea914f4d44fe9fbf631537d13a1767b2cfcd30f58347686e8f66a67db2168da5f619e649252efc48bf0c7dc30d1c9576eed3b7c08ff0161a3f0a71
TLSH
T1EED0C71145D7D79E0448A02F0AF661CDC0755C5C7F473B119721C44C61C241DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 4a7949f3c3884a7efc90ceb6a63b692d641226e929cc417ab0aa09e3ef77428d
MD5 f79b6a7a93ee37b64f86cacbe4f483a5
SHA1 e9c3af22e590bf4958ebe79926a582370862ef33
SHA512 527c9b750418a65849e23368678f6147e686c07fd6d74c54c5fd4904c2eee63cfba1769846f5349318aab0f4d52c2e7b9ae0a7249bbe4167df61be5da614200f
TLSH
T110E0920146BFDEAB000CE01B06FD694FC19465283E863B767B20CB5D52DA84EB6F3293
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 571d689c75e0201818946b45e6f655aae129c50f214d325e5954969ecadb151c
MD5 3d322f2eb84f8dad557fb957b0db6363
SHA1 5bf7902dd19a426435137ebaaf1d29e7d365f408
SHA512 d2e14a4461b1d2cb20b5ec615ffaa025eb2ecd7636d35ca4964f1d96e286b635620deff33a377182b0cc807e8dff7846bf7d8ab95d9dae17778cc1e48d6c97b8
TLSH
T15DF09BD220A2B0553711D617D7945FD727C31D981DCBDCD40348B2758D79D2C44C5257
MD5 SHA1 SHA512 TLSH

Submit Download

helab.exe

Path C:\Users\Admin\AppData\Local\Temp\helab.exe
Size 423KB
SHA256 e4c2b9659b5edb43c171fccc73200c6cc5defc667ff3c95ad4ba841e095c58bb
MD5 cca76c2096aa9f21b861bdd2a8407930
SHA1 75bc6d41afae7e10df05be8695f20f730ba6fdec
SHA512 c96faed63b08b4aaab363e787d81251c8d4d36f3e5d99fc0ad0b3ddd211bd81732a37d86a314d8f1f5b0767bdfb3a135a18dee1cfe9a03fcd8e4a40ce566af18
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iWpX:yIfBoDWoyFboU6hAJQnrMBX
TLSH
T13994BE253240C436F32A0B364456FAA04A65BC3A55D5E48FF7787E7A5D312938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jilib.exe

Path C:\Users\Admin\AppData\Local\Temp\jilib.exe
Size 223KB
SHA256 a725dc7c4849a1405fb25800678c9a8aad64c7937e587a1825b6f62efc335134
MD5 a4891036f82bd18b27da86103e896043
SHA1 272cc562ada5b04c3e2ab526edf3b4dbe44d36ba
SHA512 e6a7bddac0c48188a9b251a0b41949f210b83ac283ae7d5e672348f224c842dcbb9494722fdc998edfd73f59589d636663ec279d6d6d05a60caecd4cc7652ba2
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3y:unFhSIkAyDgjtS/FZg
TLSH
T13124E042AA018888F38C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nuqito.exe

Path C:\Users\Admin\AppData\Local\Temp\nuqito.exe
Size 423KB
SHA256 8313261d2693ae082992271229532ac32cb1f8c60bb3735f5e226396ff93860f
MD5 0801a2672f12dfedb9ed92a297cfcf86
SHA1 1b324c051e22752c4a6069ae0c3cddc255bdde3b
SHA512 c17abe362a92a7d0e617c46ee1afe67ed8c17bf7ebf82c72a943e0a3485017f148a81be08245b33c6803237a3581ef2a4dbf9f8074757fdd6a71ddd815ef1ef8
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBw/iWpx:yIfBoDWoyFboU6hAJQnrMBx
TLSH
T13294BE253640C436F32A0B364456FAA04A65BC3A15D5E48FF7787E7A5D312938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-28-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/960-42-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/960-27-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1052-44-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/1052-40-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/1052-45-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/1052-46-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/1052-47-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/1052-48-0x0000000000D80000-0x0000000000E20000-memory.dmp

Download

memory/3240-17-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3240-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3240-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4156-26-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4156-13-0x0000000000400000-0x0000000000467000-memory.dmp

Download