urelas | dee90340e70236cc52c0e2e3a504394a8b1609d055dcbba8b5ac8f214577c244

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 410KB
Sample260518-tp87psf18w
SHA256 dee90340e70236cc52c0e2e3a504394a8b1609d055dcbba8b5ac8f214577c244
MD5 714d1a15144d36b503160b102b76ff9b
SHA1 d4f522d3a4f1bd15ba8d96599ef1f43b7764f2e8
SHA512 27befa7f839285fc50cbca455156bc55e419fc8e35fcb1876516ca2bb70c529bf4f4258cd2cff6c2c99dfa85dc7a792f546f6347824f609cf53fadcde643ad03
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVRi:YIfBoDWoyFbkU6hAJQnac
TLSH
T1B794BE253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
2560	xevoy.exe
3520	cihoro.exe
3780	nyexk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cihoro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nyexk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xevoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe
3780	nyexk.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2560	2576	2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	81
PID 2576 wrote to memory of 3488	2576	2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	82
PID 2560 wrote to memory of 3520	2560	xevoy.exe	84
PID 3520 wrote to memory of 3780	3520	cihoro.exe	85
PID 3520 wrote to memory of 784	3520	cihoro.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_714d1a15144d36b503160b102b76ff9b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\xevoy.exe
  "C:\Users\Admin\AppData\Local\Temp\xevoy.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\cihoro.exe
    "C:\Users\Admin\AppData\Local\Temp\cihoro.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\nyexk.exe
      "C:\Users\Admin\AppData\Local\Temp\nyexk.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 9f3fce810d81972cedb2f6fdd45830cc9f3aa52d0c5436afdd240974c15f97de
MD5 8f015a70b2cf549d3f6b214c0f6188aa
SHA1 52f96d7f11e22efb475f6f83d58d5b9322a70551
SHA512 8beadc0f1512b3476341b9676b50fc071075858a168421cb09ed02f2be1c0acd573044396af94ffdb053ec75fe6a21c8676edd6d8f5d205b54cac0a2e368f389
TLSH
T182D09E114696D6AB0448B02B06A6618DC065685C3F863B119A21888821C141DB5D7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 d8b8e58c798412e642a82cf8d9e1d06b3e4a95d70947bc0c43a6ab40c285e48a
MD5 12de868141c0f7d9d6107abb03a90cf1
SHA1 06feb03c38431928b8c8d1b00d5c366ee774cfb5
SHA512 b86d576fa89009553e1087c18a656a650a8cce4f306696a106264e86319c391ef6fecb63b23d2a1b5df1a954327b9e5351f04c7e10fab42b445f267a3c2b671d
TLSH
T15FE02B0240AFDE2B005CC01F42EEB54DC2A0A5983FC72B323238874C51D9C9DF2B2241
MD5 SHA1 SHA512 TLSH

Submit Download

cihoro.exe

Path C:\Users\Admin\AppData\Local\Temp\cihoro.exe
Size 410KB
SHA256 cc9904cc17b22ea400a50979d8c4da484b1c23bd1b999f9c180745f7104efece
MD5 b2372da32c66c7c96ccfbd2d38d04d6f
SHA1 153a4e803b5de5336fe514693d949a75178043eb
SHA512 cb29849dfbdb5047ec52fb59b958cb94ada6ed3028f7df4552e39692619e6459091d9354199d3d5be451b1efdd170f9f52d4560672feef59a97965324d0d3da4
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVRX:YIfBoDWoyFbkU6hAJQnat
TLSH
T12894BD253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e289c6ffaa8988620614d43ab86eaf192297128e2a2eb6757b2e12486179cf09
MD5 470b627efe17abfa813d14bee77a51bc
SHA1 50e80814c1fcc2354e7174c1bb9e99f225a28537
SHA512 44df1af610f30eca77cee19ebce074b17592b55ae5424e9bf2aa07ca901b7f02629b3eea9f2c89f5702e7d08b30c12a1c4cbaf3d158f544c54f21b773744d63c
TLSH
T127F04CEE2055B5557A11A612D794076E27831D881E47CE98415871744DB68EC881C255
MD5 SHA1 SHA512 TLSH

Submit Download

nyexk.exe

Path C:\Users\Admin\AppData\Local\Temp\nyexk.exe
Size 223KB
SHA256 7cdbf4cbf881c696217c0486b85895716c0f26b8f77460a677bf402edb344f99
MD5 55a0f35f791fc240526101df260671a0
SHA1 27e3551be777b40f75f759c1fe5cb42d83ac2c61
SHA512 2aebb20a1e86dd5b91a1b9627e0d06b8894561559442bc535c9a5a5c722f15ab8c867ec0a38a4c93449cb10f75886bfa278f754f1c23feb116b00280789c0aeb
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3y:unFhSIkAyDgjtS/FZw
TLSH
T18524E042AA018888F38C4B316A17FAE449858D3C59D1F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xevoy.exe

Path C:\Users\Admin\AppData\Local\Temp\xevoy.exe
Size 410KB
SHA256 1430cbee309b52190404b9761dd4a1204e5689a435fb72de4f888e6ae4d633df
MD5 da93eac7902ed82c0c577dc72cb9ad9d
SHA1 33e6d763c8e10d7e4cb65487ce17e46b3390930f
SHA512 fa9bbb6fef92c261c9a146f9a277badfb9f3027848620a9ca87d7f9e380f39555cc8b3d495da7558774c7c747803cb54df92d8aa1c276d77648270ae22222db1
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVR6:YIfBoDWoyFbkU6hAJQnaM
TLSH
T14B94BD253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-15-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2560-27-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2560-11-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2576-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/2576-2-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2576-18-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3520-28-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3520-29-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3520-43-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3780-40-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/3780-45-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/3780-46-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/3780-47-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/3780-48-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/3780-49-0x00000000002B0000-0x0000000000350000-memory.dmp

Download