urelas | 607c1703e91d3263f5f6cfbe4f5be499a31a2a4911e10bb8e4dcbc9076f3af94

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 410KB
Sample260629-jp48msgv7w
SHA256 607c1703e91d3263f5f6cfbe4f5be499a31a2a4911e10bb8e4dcbc9076f3af94
MD5 46d9962f8a24b92b843df7b07c77de14
SHA1 c3745543f936b1c55028f6cfd72fd01ab0272e3e
SHA512 de8336137cd29e2c57ff58771f3309339fdb8c79d6ec33b93dc968b3db802686d10526950cb2d4dfdfe14721dd8136fb5c46514e7972d9989d52264d3f89e3b3
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVU:YIfBoDWoyFbkU6hAJQnaA
TLSH
T1A594BE253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
5584	dupys.exe
4956	loqupe.exe
2648	muxeg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loqupe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	muxeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dupys.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe
2648	muxeg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5584	5100	2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5100 wrote to memory of 1952	5100	2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 5584 wrote to memory of 4956	5584	dupys.exe	92
PID 4956 wrote to memory of 2648	4956	loqupe.exe	94
PID 4956 wrote to memory of 4436	4956	loqupe.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_46d9962f8a24b92b843df7b07c77de14_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\dupys.exe
  "C:\Users\Admin\AppData\Local\Temp\dupys.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Users\Admin\AppData\Local\Temp\loqupe.exe
    "C:\Users\Admin\AppData\Local\Temp\loqupe.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\muxeg.exe
      "C:\Users\Admin\AppData\Local\Temp\muxeg.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 c4527741f31b6ab6f6f7a326a357ddbdfe8b71bf96d37de615039aa922346f98
MD5 433fd8399ab0b2214ec56b22cd98a7ac
SHA1 ca17178a7124172147acaba8ada9fe71cef7d40f
SHA512 5eb5b62f7f8c60c6b96b9a86380e4477fc38105420f5b9dccedb46901b0f9d6cb06b892592b7278a8187de77bc04f0ee49a23e9ac3abf94b2f4cf32f78e41c55
TLSH
T123D0C71585DAD79F0448942B06B5A18DC0B54C5C3F473F119729C44D21C141DF9C7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 b7927b88c85634f10b3583287837924cdb16f7b68e462ce41a72449548545186
MD5 ed3709cd15be5921054563b2e6fae1bd
SHA1 041262d92570e247e536b8dd5cd00787f1b90fa9
SHA512 a9389be7eb49856efbeda91f186af8425287f341c2ec1918e811938297864bb371d12fb4513ac4c89f2d476bdc1225f313b14af6aa45ff506301edbcd7b9857b
TLSH
T18BE02B0042BFEA2A070CD01F12A875CE80A569583FC727F43620C78C91F54CDB5E7242
MD5 SHA1 SHA512 TLSH

Submit Download

dupys.exe

Path C:\Users\Admin\AppData\Local\Temp\dupys.exe
Size 410KB
SHA256 c3f7933d9ff452db9ac8ab0dac858b0189e65e93798fd7ada8382760f66cd73a
MD5 82a59671b726053f6ef500b85a6bbdad
SHA1 4530fb0155d67e3e3f67d5e33242b94e6e31369e
SHA512 3bf40078ae4655132f57f025fd2f7fa848beb71f8b2df7895b284065b8ed224e2bbcfd9b01f97938b969a029ebd735f0e826da00c30a0ef8cf33e8514ff4d727
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVg:YIfBoDWoyFbkU6hAJQnac
TLSH
T13994BE253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9b2e626d9dc0aa7b45323f41230cce310f92ca3588e17a8a655c103992bf0a9d
MD5 427dbd9d5a1a0831d231192443487e65
SHA1 6ddabbddf1d02e82b38601127206cadfbb6c852a
SHA512 825c353b0a2269d291b2dffa467bce799234b11ae68a447187db3c0ba44aa2afad031a1911fa80ebf5c980f3d902b43ebaa66a454dae5d332bec815b460c52e9
TLSH
T134F04CD12091B1453511F613D6891B9A17934DC91F8B9D900149B1B08A77CAC4844296
MD5 SHA1 SHA512 TLSH

Submit Download

loqupe.exe

Path C:\Users\Admin\AppData\Local\Temp\loqupe.exe
Size 410KB
SHA256 49cd411371dc5d18747444bc7c3fad4be82e71281b9ba1c787a7785c9c2beef1
MD5 4eb5360073f0274ebbea12febf3b28f4
SHA1 4fb446b745a5636a90bcd7b7746d712a2172d32f
SHA512 e4442d7ad90032b6d4b662007918115013bd2ab83b81a75e08f366b6475e98ef2641e63797d51ebbd5d6b8429b0cb4b53a6e869d2b66fb8af7156370c34c6678
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVU:YIfBoDWoyFbkU6hAJQnag
TLSH
T11394BE253540C436F3290B354455EAB10AA9BC3A14D9E48FF778BE7A6D321939B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

muxeg.exe

Path C:\Users\Admin\AppData\Local\Temp\muxeg.exe
Size 223KB
SHA256 7f06370c61376bebc28218ef68b1831db5a531c022275ec6f1f7414aa0cdaedf
MD5 737b19152fe0fbacc6c8ba0da47eaaa9
SHA1 b19bdf7d299aebf18629f603d514fcfa35e969bc
SHA512 7165105aeac8c41567e28fdeec61cfd120a68f3c3fd3cb1220bf1fce466a9003cd2ae554d74149cb86ef739e33049ac972a5614a31b81953be42a7cbf339d955
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3J:unFhSIkAyDgjtS/FZj
TLSH
T13D24E042AA018888F38C4B316A17FAE449858D3C59D5F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2648-44-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/2648-59-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/2648-58-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/2648-57-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/2648-56-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/2648-55-0x0000000000770000-0x0000000000810000-memory.dmp

Download

memory/4956-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4956-52-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4956-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5100-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5100-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5100-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5584-32-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5584-14-0x0000000000400000-0x00000000004679C5-memory.dmp

Download