urelas | 1c63323e4cf137b58b3731484f97f2f4c463b0009df972ddbb00897e5c23c2a9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe
Size 2.2MB
Sample260524-28fcqsct6v
SHA256 1c63323e4cf137b58b3731484f97f2f4c463b0009df972ddbb00897e5c23c2a9
MD5 d9cebc60eb86fe1569e8d09fe4069029
SHA1 85e6b907e48a87c4c7dc7be9e898e15a53ab2b5c
SHA512 60bee6004b9fd1d955033f5dfcb10eb6c3638522f7a14c80a7f2fe403d2d36b940de2f80471653e4830e200809c97e7052b5b81107113b46072f8111fba4ee0e
SSDEEP 49152:tmgqWDlmt+OCi1NqvNgyhIZ0tFYh1W1rJ/c8cifaE9+WagVGhUETtHWSQLQRQucH:pqimt+Ov1eNgyhIZ0tFYh1QrpaE97agB
TLSH
T14AA5BF2A36A18076CA3339314A4DF3B9F6B9AD704935022767A03E3C2E715935D2977F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
5344	dofhir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dofhir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 5344	5232	2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe	81
PID 5232 wrote to memory of 2792	5232	2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_d9cebc60eb86fe1569e8d09fe4069029_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Users\Admin\AppData\Local\Temp\dofhir.exe
  "C:\Users\Admin\AppData\Local\Temp\dofhir.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dofhir.exe

Path C:\Users\Admin\AppData\Local\Temp\dofhir.exe
Size 2.2MB
SHA256 3743489745096977141a4eb834b7ae71d7d5fbb0179f627442d9561322b4c3c3
MD5 be8a12c1ff725c70c43da84707f3f750
SHA1 445c83eb0ecaec5f334ff16bd6402e4988eb0c07
SHA512 7f90d1981885b447bd6055f484d3ae3768583f2286a6e6e7f1a07c7794e79fe06e64d2ac45889c93ddb11b5937c6dcb1c8c6ec80b450e8d6e9a520470c5cb4d3
SSDEEP 49152:tmgqWDlmt+OCi1NqvNgyhIZ0tFYh1W1rJ/c8cifaE9+WagVGhUETtHWSQLQRQucD:pqimt+Ov1eNgyhIZ0tFYh1QrpaE97agt
TLSH
T1D8A5BF2936A18076CA3339314A4DF3B9F6B9AD704935022767A03E3C2E715935D2977F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f6ac51f63e05e0c1e484b9a0df249ea47e6db7e72b603191235b19fb486a0efe
MD5 64bd6ce7bbf11d281db681ed92eef333
SHA1 2034da53aac1d1bb31412abd3374518956556beb
SHA512 5063a264be28eab5fdae7684427cf23fe80d79d14305f516c41871422daefd8a9b39bc715098bb955b623514f0c0781b0d8b516e0bf0f0ef8c6c7736b106ba26
TLSH
T163F092A400A6F19C3212A505E52AF7312362DCDC204DBC4906D7B335A23105C80D807A
MD5 SHA1 SHA512 TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 350B
SHA256 152f15afbbd06b6224621871e3766838c1c65731501828e62af8b24f632e2205
MD5 a8e50fe48fa41c1499e0e83fc2334889
SHA1 6cc78568bbed8ca8edcbfaf39145f56c8b57f2bd
SHA512 fc1ecdb223979e710dd698447e4b281cefab0823a4a280b575ab67b86e352519e4a6a0902551f41de7f18965e261138ad083b4b72430d8e4cd51d67fa8ea1222
TLSH
T1CFE0265201FFDE0F0808A12B43EA1ECCD4A9684D2B473B246712C5AC31C082EB5E3701
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5232-0-0x0000000000A70000-0x0000000000CAA000-memory.dmp

Download

memory/5232-1-0x0000000000B8A000-0x0000000000B8B000-memory.dmp

Download

memory/5232-16-0x0000000000A70000-0x0000000000CAA000-memory.dmp

Download

memory/5344-15-0x000000000064A000-0x000000000064B000-memory.dmp

Download

memory/5344-14-0x0000000000530000-0x000000000076A000-memory.dmp

Download

memory/5344-19-0x0000000000530000-0x000000000076A000-memory.dmp

Download

memory/5344-20-0x0000000000530000-0x000000000076A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads