urelas | a9f62631b634a7683051273335496a1153c55d7189b24552f45c6c9babe0aba1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 455KB
Sample260504-wpb83sdx7l
SHA256 a9f62631b634a7683051273335496a1153c55d7189b24552f45c6c9babe0aba1
MD5 36b1b65212114e825f3c676a44dbfa47
SHA1 1dc35b0e8e4eb597241a7d4ff09b23497be0a16e
SHA512 59e7b2d55c191089a9d009b552fda0634db7552f0221db8636fcf4673376842df4f088def86701cec0bb08cf3fd0bd2b4b59937bef5e4cabf3310e8eaacf36e4
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpopB9k:PMpASIcWYx2U6hAJQnO
TLSH
T1D1A4BD147640D472E32A0B310456EAB449A9AC3A17D9E48FF3387E766D312D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	gabyn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	qoebbo.exe

Executes dropped EXE 3 IoCs

pid	Process
2956	gabyn.exe
3884	qoebbo.exe
1100	rixus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rixus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gabyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoebbo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe
1100	rixus.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2956	5064	2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	85
PID 5064 wrote to memory of 3904	5064	2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	86
PID 2956 wrote to memory of 3884	2956	gabyn.exe	88
PID 3884 wrote to memory of 1100	3884	qoebbo.exe	98
PID 3884 wrote to memory of 4452	3884	qoebbo.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_36b1b65212114e825f3c676a44dbfa47_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\gabyn.exe
  "C:\Users\Admin\AppData\Local\Temp\gabyn.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\qoebbo.exe
    "C:\Users\Admin\AppData\Local\Temp\qoebbo.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\rixus.exe
      "C:\Users\Admin\AppData\Local\Temp\rixus.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 0217cbbd6b847b621507a854ed07369acd6a4bb45baf5b369b8e8fc80924fd25
MD5 9762101879c59be41b12c6d8cfa76172
SHA1 bd11cb2a891f4c2a5f1c521e7bfeec858b74ccf2
SHA512 b9ac3e1f6ff2ebb97410e9f512e78bf6a61177b8a85f23653301b0b1553222e547fb69f8ad049bdce3b8fa6b2c18781a43048914f56ccdc460003e10ab68d0ee
TLSH
T100E02220446FEE7B081CC21F06A8658EC0A885287F8737717330870CA2D985EB5A622A
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 71079eacab533ab6f88231951cfc42d3ea31dae7269228cf6218ed7af9511a28
MD5 9e40e18b54bed9bfa7f7d58e9f27bd90
SHA1 cd65150566b9af76f57cfd5b964e6975bf279620
SHA512 d27dc41f3c85ff8a118f175859c79e8c46ce31557dd855a08ad7144aee6d8e82ed070d34bcb9c70e34426e37eec2f4798c98b8457ac1ded342fef21d7baf255b
TLSH
T1B4D0C75141D6E79F0448902F0AB5A58DC0755D5C7F973F119722C84D61D1C1DF9C7351
MD5 SHA1 SHA512 TLSH

Submit Download

gabyn.exe

Path C:\Users\Admin\AppData\Local\Temp\gabyn.exe
Size 455KB
SHA256 e4f35c9565c02ddd676cbb0f88d7686eeebc98d0d20a9aba834711ef5b59ab41
MD5 02f241e1a60ef7e3424abe2312413835
SHA1 acf0117a6d3bb6706a9cdc5de1ee6309d37e79c3
SHA512 f69b48bab582f039c46fffa76427309a20eaaeda26c72d9759834fbd3976d19bafc76120515bacb976319097a108ae1a9c01f2e2f0a08ce56e3b1ecdbd497562
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpopB9y:PMpASIcWYx2U6hAJQnE
TLSH
T1C7A4BD147640D472E32A0B310456EAB449A9AC3A17D9E48FF3387E766D312D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ef30ae6f910050a7d1fb0d940a30fe771bf4ad9ff84e09238e46195b7e9f9287
MD5 736ad2963ebfe6721c123ae673b4b5da
SHA1 8c1fc590495f3a5590c081b388db88493d1cdd1c
SHA512 be6eef7fbaf872296bdd3271672300985b603d651da94af583c3f148902d17e112ba40b8fc73bdea7f4b04f7d98f701db2f9a37e152336f917b54cb08ac39e79
TLSH
T16CF09BD53491F0457511F613D3A447D723A31D887F439D510145B7314D77C5C85843D6
MD5 SHA1 SHA512 TLSH

Submit Download

qoebbo.exe

Path C:\Users\Admin\AppData\Local\Temp\qoebbo.exe
Size 455KB
SHA256 3782593206eeb687ab9ff1f79f7844e41d06c977a45c687d6a88b47dc7e7c265
MD5 e5a5e77b3bd993e64e0df9ccc7d28c85
SHA1 c148a6c07747f75c8807c88d8046dc85c1f84111
SHA512 18600eb430ba72c294159eaf2892c4470fb1a19db3064e5cb6d53e7877d6082187fd13770127918bc7b0cc2368961370cee5147c4dbd975c5ca8f44f8ff4a977
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpopB9L:PMpASIcWYx2U6hAJQnF
TLSH
T16AA4BD147640D472E31A0B310456EAB449A9AC3A17D9E48FF3387E766D312D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rixus.exe

Path C:\Users\Admin\AppData\Local\Temp\rixus.exe
Size 223KB
SHA256 cc81eb0974614a7512bbeed0e69da6d0e8b9484986265c51d5983ccca9b25541
MD5 72c501de44947de359fd8307f77af341
SHA1 d96e858882907ba4bef363241bfeb0c6ae0c138c
SHA512 35bd11096d67b61046cf5098e44d8f88e21f65932ba1d66f82629a47e13c0061184fe25d4b950f250947701d3cb3f56cda9fde7fb34173ea2443617ab80ee9be
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3G:unFhSIkAyDgjtS/FZo
TLSH
T12624E042AA018888F34C4B316A17FAE449998D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-57-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/1100-59-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/1100-61-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/1100-58-0x0000000000E60000-0x0000000000F80000-memory.dmp

Download

memory/1100-56-0x0000000000E60000-0x0000000000F80000-memory.dmp

Download

memory/1100-63-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/1100-49-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/1100-55-0x0000000000030000-0x00000000000D0000-memory.dmp

Download

memory/2956-27-0x0000000000780000-0x00000000008A0000-memory.dmp

Download

memory/2956-28-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2956-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3884-32-0x0000000000840000-0x0000000000960000-memory.dmp

Download

memory/3884-52-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3884-51-0x0000000000840000-0x0000000000960000-memory.dmp

Download

memory/3884-37-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3884-29-0x0000000000840000-0x0000000000960000-memory.dmp

Download

memory/5064-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5064-16-0x00000000007C0000-0x00000000008E0000-memory.dmp

Download

memory/5064-17-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5064-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download