urelas | b77f39421d74c1eba48ffbb88a3f87fd7895bff41aac7e5406e756b68f7e99b4

Analysis

max time kernel
150s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 592KB
Sample260701-26adpsht61
SHA256 b77f39421d74c1eba48ffbb88a3f87fd7895bff41aac7e5406e756b68f7e99b4
MD5 0d52507af7fb9c83280a9e520e494d29
SHA1 9d103fa56ebad385285c32cf9f772d636d9b6359
SHA512 b524c84dd5a61cf74c5286d7f7d3fa8781f52903d6bb4a07a042e0c2b5516e73b46ed61302d22db05c389d54908c4bf90763dd37410aa4c7af0e424ec8d14191
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMr:8MpASIcWYx2U6hAJQnhr
TLSH
T1EAD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
596	opohb.exe
5404	nivexy.exe
548	angiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opohb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nivexy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	angiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe
548	angiv.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 596	2792	2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 2792 wrote to memory of 3444	2792	2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 596 wrote to memory of 5404	596	opohb.exe	91
PID 5404 wrote to memory of 548	5404	nivexy.exe	92
PID 5404 wrote to memory of 1364	5404	nivexy.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0d52507af7fb9c83280a9e520e494d29_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\opohb.exe
  "C:\Users\Admin\AppData\Local\Temp\opohb.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Users\Admin\AppData\Local\Temp\nivexy.exe
    "C:\Users\Admin\AppData\Local\Temp\nivexy.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\angiv.exe
      "C:\Users\Admin\AppData\Local\Temp\angiv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 48fb2aa30fac01e74f36dbfeff74b6da14af8348df13e5af22135d272ed23e78
MD5 5bd41f98d9a6378ae3648ad5ecb16124
SHA1 859eea3b7102fc1309bf2773969dfb3ab9a48b8b
SHA512 b051aff1bdd2043fa15057190255870eb08f57bb8afa0ea701dcd5d193acb542fc438a9071a63d9730ad5104e2d596d4f71832bb1a720dcae568c21523b2a4dc
TLSH
T16DE0E50150AFDE3A014DC01F05A975CD91A986157F873B712610862C61E545EB9E6251
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 5a70585acf38bc361ada2bd99b75daaa909e7bb5d06c885f0e1f0bd91bafbf2c
MD5 0c726ba2d48b540d7a95863006cbb1b8
SHA1 e6ebdcbfdc77e9cc4cbf1d8219316df79caa9094
SHA512 dd9e31a57cf7c01809afb0b61ae7e68e54dff157aa9b8db5039f1dc7f55189d25841025726266f2f05c13b6253c763fb4fc8f1db11643ace80b8b2dc4143c94e
TLSH
T1F3D0C71681D7D75E484C913B46B6628DC07D4D5D7F473B21D725C84D21C181DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

angiv.exe

Path C:\Users\Admin\AppData\Local\Temp\angiv.exe
Size 223KB
SHA256 9b46a90b37f9e6de2e78c7637c81c7a294d69073f29aba850bde4bb9cd802237
MD5 903fb25ebe38b6a328c0a663f722f3ab
SHA1 756fc6780982f7ee7415f99f54f0f4bdb5e12782
SHA512 fbe8cd7b930e272da5acfb0a44ec6055585c15d5d62fd937fe44991f4599d7e10e35e23fbfe08b188bc3d4d9905237d3ea22a496cd4e7d4ab96807e35a3c017a
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3L:unFhSIkAyDgjtS/FZN
TLSH
T1FC24E042AA018888F34C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f4c31b2c1ffa4532fe593b0421e1016e4a2e17a9d3e49a8fa51a444de539a226
MD5 0992908a9eeebf51a595662c7f08639e
SHA1 63e239f9c417902874304709300966167fbfeb1a
SHA512 87bcc3976b30219e9db61593869189e27ca53fd04df2b6dedb1394092136dd7231a656ada1fa99b3a98e6e59d72ed5f9dd037c38b88e485e5e4fa5dd1ffc1266
TLSH
T16CF02BE51020B0563642E323F38427C037A30CC41EC7CC48024CF2704D36E4C4800295
MD5 SHA1 SHA512 TLSH

Submit Download

nivexy.exe

Path C:\Users\Admin\AppData\Local\Temp\nivexy.exe
Size 592KB
SHA256 208bb511c81a61d9834bc7fd3941c1d170ef29c47f0830c4e52d20934a6b6c05
MD5 f3c636744174dc294f7cb252046a4939
SHA1 43655a9491ce81984d999f7eb850f54f9f2b3fb8
SHA512 9101bc9f1b25374c42a76b62252335dec34fac3779c178ac3638f3ae7208bc52633a54f2bcec78d1cc070ed4e8bbcf3124759eb6c661d807cfa981c308d25125
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMh:8MpASIcWYx2U6hAJQnhh
TLSH
T1C0D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opohb.exe

Path C:\Users\Admin\AppData\Local\Temp\opohb.exe
Size 592KB
SHA256 8014522f2ec3294c024ca7b0477bce22b0fd92c022d47dbd07f6e233ab2fa39a
MD5 555bf4b3b440bae483be2fd879bdc603
SHA1 eb98d610e316caa797efda8c9f08558e51f7b2d0
SHA512 dae2210fa09940c24b8ede709e0db995114f63ada1e6637300d5c2e018fb7b7278eb3b9fe19421e67b5e781a68566cc30ab2ed1d76739271b57468a9911d956f
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMI:8MpASIcWYx2U6hAJQnhI
TLSH
T1D6D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-45-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/548-59-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/548-55-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/548-58-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/548-57-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/548-56-0x0000000000EC0000-0x0000000000F60000-memory.dmp

Download

memory/596-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/596-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2792-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2792-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2792-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5404-52-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5404-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5404-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download