urelas | e88ec3e0c5082673b53b3ca80284f1a51cd6fad6d4052a576f24b1040b9ef76d

Analysis

max time kernel
150s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.6MB
Sample260701-e3v5nses9r
SHA256 e88ec3e0c5082673b53b3ca80284f1a51cd6fad6d4052a576f24b1040b9ef76d
MD5 6e1cfb248cdf764a5bab69c97a1ed638
SHA1 79b5f1f0d5e06e934d044459a48589ac72576320
SHA512 a69d92955c3c33c0d417217a0b2815233fbfd6a84e6a15af2f97ae5bf33865858f902b2e558fbe95a66b6922e520e55ae4baeb04da4896f9ccfcc1ce54db50a7
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXei:UIfjoga66AVDKUTbQIzFLwLi
TLSH
T1CE850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
908	kuuvg.exe
5860	dulezu.exe
1396	qytow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kuuvg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dulezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qytow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe
1396	qytow.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 908	2668	2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 2668 wrote to memory of 1292	2668	2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 908 wrote to memory of 5860	908	kuuvg.exe	91
PID 5860 wrote to memory of 1396	5860	dulezu.exe	92
PID 5860 wrote to memory of 3776	5860	dulezu.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e1cfb248cdf764a5bab69c97a1ed638_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\kuuvg.exe
  "C:\Users\Admin\AppData\Local\Temp\kuuvg.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\dulezu.exe
    "C:\Users\Admin\AppData\Local\Temp\dulezu.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\qytow.exe
      "C:\Users\Admin\AppData\Local\Temp\qytow.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 444B
SHA256 0604ec3618e6210e0a43373ab0fd1eeb32f4490a0fa5a733fd887df95c14a18f
MD5 548d125f328ef9cf527c09e986c7da1b
SHA1 c2ec9b5907b971a84a92144808b029bef310578e
SHA512 8ebf05b53dc2860c8c9c7fed1bb37f2c646d203aec27bb26c22e79d82ac237e1dd242d8a022a2bd3511061f15ee743d6c33bf09d3a9b78e713a2c721cceea2d2
TLSH
T198F0E51002AFDD6A041DF01F45A8F54E81A4D5597F832F313320C60D62EA8DFF9E2212
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1efc5ee6c0077ccb2973a6b5a222eb5c0dc0a0a075c3e32cbfc45d9848406a74
MD5 21bfcf481a3f02e29e58bb2407a7f7b6
SHA1 a53cb7b4725c5312ad7e33f5f468e8414baa7805
SHA512 850b8e60d159e89c1dfdb8c7e2197a76b6d8f32635675589382c251299fc1694820626a18236ea5612681850450ae78832fc3f9a492e1a4c12b259fe7f0e5402
TLSH
T1ABD0C71145D6D79E4848902B4AB661CDC6755D5C7F4B3B119721C44C61C141DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

dulezu.exe

Path C:\Users\Admin\AppData\Local\Temp\dulezu.exe
Size 1.6MB
SHA256 b4522c08789cb2c703a6e627163c1e35a053099ba0cc268bde69c0b85d591933
MD5 4bdf2610e30d4d43faf5c9595fea660d
SHA1 bd7ad6bc8f402352a96491eeaa7fb3838b2b6b64
SHA512 cd53df249a75f68fe0c5ca288da233640217d55252ef4f0011b7a96ff6641cd7b13e8da396582a29bc8fe140524ddf70b24064016ff46591fc3b24f49cff183f
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXe1:UIfjoga66AVDKUTbQIzFLwL1
TLSH
T1A5850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9f814599bbcc8a108fb6baae5dbbb8db4484b75d096cd2785d9d43612042fa33
MD5 07b054f9e1fcf8d04a2417c89faa5f9f
SHA1 a958bac4c7d242b6d7b21b05b47348456a851b67
SHA512 1822b93be1cc7aed6ef5d6fdb2be85c45e60ac6f262800b133cd9c336b6dfff755103c8e5872bbecb1ffe1402fd82b8def3d2479cafde6fc3f55bb02fd711da0
TLSH
T190F04CD51071B0463511E913DA981B6A17B35D8837879D9401457270497A8AC44987D7
MD5 SHA1 SHA512 TLSH

Submit Download

kuuvg.exe

Path C:\Users\Admin\AppData\Local\Temp\kuuvg.exe
Size 1.6MB
SHA256 d2edb6464e009ce5b861ec2e32ee83e33bdef28cd3efd25ff8edabff41f25860
MD5 f50091361986892ef8f800a87aa17cbd
SHA1 3364347d9c4aaa7b7be9963d67236758c790c0af
SHA512 c8d5766d8dfb3b4a7b2cfd8b97c15052e9ce1ba4459934a04b4d5e3936f498b91c611e6783a5d8ca2fd623ffea318bb2bb2511096dc2664ab0aebe75c0945ec4
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXep:UIfjoga66AVDKUTbQIzFLwLp
TLSH
T1C1850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qytow.exe

Path C:\Users\Admin\AppData\Local\Temp\qytow.exe
Size 223KB
SHA256 4610350fee391fbbb6d031c96e8109c4446c2e67980cd10495ad9a25d4f36c6c
MD5 8bf9f74dde7f3830c19dd0e19a84c314
SHA1 cb78f2ff1472fbef3471c4f9b488e7b233651ee3
SHA512 8a55ff1b65e2bbe0a61c468142b2786a01e55db66c013e8fa1be67ca4645a36ad6838fa27025b2e402662dd82dcb5c2855d03c852303744f455d73871ec8b214
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p34:unFhSIkAyDgjtS/FZS
TLSH
T12024E042AA018888F38C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-34-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/908-35-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/908-19-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/908-14-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/1396-48-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/1396-64-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/1396-63-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/1396-62-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/1396-61-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/1396-60-0x0000000000620000-0x00000000006C0000-memory.dmp

Download

memory/2668-23-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2668-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2668-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5860-38-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5860-57-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5860-56-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5860-32-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5860-36-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5860-37-0x0000000000400000-0x00000000005AD000-memory.dmp

Download