urelas | 85b069a5ba105beaeb84026c292d9b478168383d5edde34aea3ca57df13ea291

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 402KB
Sample260630-b4t28ab16w
SHA256 85b069a5ba105beaeb84026c292d9b478168383d5edde34aea3ca57df13ea291
MD5 edce87c52df7914858a3e2d9b7658ea1
SHA1 83ef1dffa972412d594ef75d58872b128a8b62b3
SHA512 f8c4a0ff270307cbe00ffd127e6089665e8e058be2275a682e465b0a964906ee082541aad92e1f82fe72f9237377e88418a47f4138c3cabdae947e48e8e3bf99
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEl:yIfBoDWoyFboU6hAJQnrt
TLSH
T1A094BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3224	kyzim.exe
1760	waboly.exe
5024	roqij.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyzim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waboly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	roqij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe
5024	roqij.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3224	2880	2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	87
PID 2880 wrote to memory of 1448	2880	2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 3224 wrote to memory of 1760	3224	kyzim.exe	90
PID 1760 wrote to memory of 5024	1760	waboly.exe	91
PID 1760 wrote to memory of 5192	1760	waboly.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_edce87c52df7914858a3e2d9b7658ea1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\kyzim.exe
  "C:\Users\Admin\AppData\Local\Temp\kyzim.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\waboly.exe
    "C:\Users\Admin\AppData\Local\Temp\waboly.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\roqij.exe
      "C:\Users\Admin\AppData\Local\Temp\roqij.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 def9d9436458ef6cb17163710d72f64063ae32a463081f99e89320f9d551caba
MD5 18f6e9b3cc954f25b7f268d65f216c40
SHA1 32fa2885fee91d47523d9a008440ec746d1c2620
SHA512 b98b800dfb5b8a72791281fb48f8c37d6d29565db38f8ffebc70045a0cd2629a7e7fdcfb7cca15a19e070c4c5d563f3c3295532ad3aac76b6c7c1772c0042c9d
TLSH
T163E02B0001AFDE2B421CD41B01AC758E919049983FC72B393211C78CA1D949DFBA7242
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 2eba3841511dbbd5ebe50c13d086aaa8957b3f64becf6154e1c162ff14a3b1be
MD5 2e56dad6fdba0d1c6a25e0de44a43a90
SHA1 830bd90a5f1eed0efdc036df9944b0866fc4ab2b
SHA512 88fed1398525d7435f626b69af2db1f948e67620119a7b57639773a091e5b68a8644ca077a56f4e80ebc0a7c635602b24623486264187ee27560ab2b75ca2379
TLSH
T110D0C91181DADB6E4858D0AB0AB5628DC0758CAC7FDB3B21A721C84C22C2C1EF6C7382
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c5ce56d4a54fd6f842cffc3b28d7b154472915d8c1a81e7c40e83e9a81375eaa
MD5 e65048fa307d4d1c23620b080508c4d0
SHA1 2f93217ebe9aa88ae53d7299ea3cc674e239dfe3
SHA512 645e120f5beada3a5a71231c1153442595e448a0ee130ed64ceff6ecaaa05ca5ea176c77486008745aeda20488c761c5f316cc779ce9c20d0f142c0f2863553b
TLSH
T128F09BD62272B0EA7712D112E7841F9967930DC918CBDD514158B5704D75F7C85C8717
MD5 SHA1 SHA512 TLSH

Submit Download

kyzim.exe

Path C:\Users\Admin\AppData\Local\Temp\kyzim.exe
Size 402KB
SHA256 6a1c08e8158f6b2dedbe860b5be118c21186dc9b71d842d7dea2609f30a2821f
MD5 6cf147f21e1703fb248fc0acd56b4cfa
SHA1 316a27cddb8543385fab0ccfb0a54ecc9ac0b57c
SHA512 d45f0c98852ef578680d60708e62936052f0c04dd3981de11c158b884207dee9dcf62ab94ba9f5f03e820a93daf08800f52fa4982415076c3f2abaafd1fc8cca
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEJ:yIfBoDWoyFboU6hAJQnrx
TLSH
T17E94BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roqij.exe

Path C:\Users\Admin\AppData\Local\Temp\roqij.exe
Size 223KB
SHA256 4a31d826434fcbad0bd87a010bfe57c7ee23436223c1fa5cbdeed27b2179a9e9
MD5 ab749a6c9f8fe0ec92e7ffd092c944a9
SHA1 25d96e3c8ad90ce029bf6f5b2ef73dc0c20bb7d2
SHA512 244e249341329179c780ad58a66be28ca1c78182346ba5c50dc956ee7d82872853a4081abaa8cd137e142b1cde3ed1984cd12f6679b5eace4ddc7e6599c5c142
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3E:unFhSIkAyDgjtS/FZi
TLSH
T11224E042AA018888F34C4B316A17FAE449898D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waboly.exe

Path C:\Users\Admin\AppData\Local\Temp\waboly.exe
Size 402KB
SHA256 a685ed41f2e09571ea0c67ab6a64e7d8ab11bcf2d787edeabc19c51151073db7
MD5 c28da2dfd02a3ad5752b5de842022310
SHA1 0b0083978a6ab881c63711d926ab812b4f2b989e
SHA512 337ee06491e2e492e8b8b145419bbfbfe1381f751685c25484c066fef10484d735cfdd8f1bc9e83801c80cc316afbd013606021293a18a5df8bb013012afee2a
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEC:yIfBoDWoyFboU6hAJQnra
TLSH
T1CC94BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1760-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1760-52-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2880-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2880-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2880-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3224-18-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3224-32-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5024-45-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/5024-55-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/5024-56-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/5024-57-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/5024-58-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download

memory/5024-59-0x0000000000FD0000-0x0000000001070000-memory.dmp

Download