urelas | 14d841d03bbec544f993d225cbfc384c2841412c913fee71670d3414cb06cc1d

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.6MB
Sample260705-d4xt8acx5k
SHA256 14d841d03bbec544f993d225cbfc384c2841412c913fee71670d3414cb06cc1d
MD5 ac2a8a290f84ee06baab8e6c4df0d615
SHA1 564fba3127ca9a92f22813ac34ffdc835feef0d2
SHA512 3369aedc85aaedbc2064999dd124f74327353804bba960725c718bfe4a9977b024620e0dd467568e91303358d20739cf0f3bfeadf1d743bea40430b1e9e78a22
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeE:UIfjoga66AVDKUTbQIzFLwLE
TLSH
T1ED850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
6136	xatiq.exe
5872	cyofki.exe
1688	siofz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cyofki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	siofz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xatiq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe
1688	siofz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 6136	4644	2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 4644 wrote to memory of 1944	4644	2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 6136 wrote to memory of 5872	6136	xatiq.exe	91
PID 5872 wrote to memory of 1688	5872	cyofki.exe	93
PID 5872 wrote to memory of 5504	5872	cyofki.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ac2a8a290f84ee06baab8e6c4df0d615_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\xatiq.exe
  "C:\Users\Admin\AppData\Local\Temp\xatiq.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Users\Admin\AppData\Local\Temp\cyofki.exe
    "C:\Users\Admin\AppData\Local\Temp\cyofki.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\siofz.exe
      "C:\Users\Admin\AppData\Local\Temp\siofz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 444B
SHA256 4b76eca6959d9e7955ebb66e055203d57b7ae235e8e41f548c8f4346352d07e1
MD5 82fd03b7deab090d5af68e76fe46ea28
SHA1 6bc12011b5eb32f156cac540ce89c2668296be23
SHA512 46ed71cc4f9be8f9346478cb2f3b3e1414726fc925fd4c82f974a937fe14151049a6296138d116db987475689ae35a64aed89e57c1d3e7916e9f095ee0aae32e
TLSH
T1BDF0A01200AFCE3B041CE01B09A9F54DC0E0DB997A862B716224C74D62E589BB2A2643
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1c1b4d7896aa054ed00536da10f2808771dcc71bdbc37ae9c748fd2581adcab1
MD5 269a9862f06a95af4c33c5ccaa025242
SHA1 31be9aff19c097b307db649aac0463fef17bf063
SHA512 2a19a2a68f1bbc18ae37ca66a365f90f76707c8765e307c3c18ad11e656f25c5679e5a10843252d6f49ebcb996376eab714fc1a6332ad4403cab77c93706dba3
TLSH
T1D7D0C71281D6E75E4448D02F0AB6B18DC0754C9C7F877B11AB21C44C21C141DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

cyofki.exe

Path C:\Users\Admin\AppData\Local\Temp\cyofki.exe
Size 1.6MB
SHA256 1f3a1185cd664a59fd637f96a778f1470991756a1c5276824102368eb523482d
MD5 8798edf2d3161b41fa0a224a9e484861
SHA1 960029939c7124cdb3243ca0ec0ce0c79d202caa
SHA512 183ef78b95596dff6ca01f189db291dc3a4988f2487fa6cf7b0a297d31262d80285160a6c5356516f7e8a362ed6aa651c39dd9a930a339a0e2adbc12d5aa0668
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeK:UIfjoga66AVDKUTbQIzFLwLK
TLSH
T112850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5b4e15987899d969a3051f240f01b49f10dbbaf584f69c947ea6e0a14e385190
MD5 7f1ee8cc03e0d86ff042dbfdaa322281
SHA1 7cd5d3b0b19a6990674d499278422665cefa6d13
SHA512 efd069530b1691bbe9a99779637876c65c4b6d3f997e9b4133cc9ab3d4c86b3bfe298d5c5512cc4636870d50fb6b1cd4ba36f28f18119492650efa2afd2f9f7b
TLSH
T1FDF04CD62461B0467611B533D6941FD4279B1DD85487DCC44105F1214A34E1C858435B
MD5 SHA1 SHA512 TLSH

Submit Download

siofz.exe

Path C:\Users\Admin\AppData\Local\Temp\siofz.exe
Size 223KB
SHA256 bb4ebcd5c9faa9a8489adf024226ebe36c16b88aa927c21f2906afa5ea38df09
MD5 0fc15c052326e7c92365ef0050fa8138
SHA1 de5c5f7b82768aa2154fe2fe54d3ff59f6f56e91
SHA512 4d0962e2f52dd1a4512e2cf0b75fb5c196c671c5aba2d8a81e6195245e009097469117e4b92cfdbb06be935f535de11f40c0651c1f4724a638429d65d81636f1
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3K:unFhSIkAyDgjtS/FZA
TLSH
T11324E042AA018888F34C4B316A17FAE449898D3C59D1F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xatiq.exe

Path C:\Users\Admin\AppData\Local\Temp\xatiq.exe
Size 1.6MB
SHA256 9dd43e83a8350de413a35ce6113a078c0c5e78b81ee20376e8f36eac8ad27307
MD5 f5684d55b9f351954ae794fc11556acc
SHA1 f5c43200a4a277f01e891e11b14c1d615357b082
SHA512 22f4db7d040bf53a90c964854055f076dc3f58753bac962dcabd77748c0e803b9a9009d3b95bcf9abe3a830117f5844f56610ebffd54c9a70d39de504776169c
SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXea:UIfjoga66AVDKUTbQIzFLwLa
TLSH
T162850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-61-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/1688-64-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/1688-60-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/1688-63-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/1688-62-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/1688-48-0x00000000008D0000-0x0000000000970000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4644-23-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4644-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5872-31-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5872-38-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5872-37-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5872-56-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5872-57-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5872-34-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/6136-21-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/6136-36-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/6136-35-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/6136-13-0x0000000000400000-0x00000000005AD000-memory.dmp

Download