urelas | 1fd479f1f88fe066d7bcc5ed429cf1fa9243fe7aaf1ead447e0661d2f6d228fc

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 593KB
Sample260715-j7nnlsay41
SHA256 1fd479f1f88fe066d7bcc5ed429cf1fa9243fe7aaf1ead447e0661d2f6d228fc
MD5 2adebfa6d5237a5df598fd731148b6b1
SHA1 5828a53cf316f08c08f917a6a54ea317bd9da1a7
SHA512 af8dbd46b0450310248d2665ed8f01911135fe074483c08beab13f908261f942db0c67948d821b2938307f22177cad1ea6d1e45ae8e3015f0f7bb0297538664c
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMF:8MpASIcWYx2U6hAJQnhF
TLSH
T1B6D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
1428	morud.exe
3208	zohool.exe
5808	bosix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zohool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bosix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	morud.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe
5808	bosix.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1428	3596	2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	87
PID 3596 wrote to memory of 4620	3596	2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 1428 wrote to memory of 3208	1428	morud.exe	90
PID 3208 wrote to memory of 5808	3208	zohool.exe	92
PID 3208 wrote to memory of 1332	3208	zohool.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2adebfa6d5237a5df598fd731148b6b1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\morud.exe
  "C:\Users\Admin\AppData\Local\Temp\morud.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\zohool.exe
    "C:\Users\Admin\AppData\Local\Temp\zohool.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\bosix.exe
      "C:\Users\Admin\AppData\Local\Temp\bosix.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 c2544756782fcc22f3eaf2f3ea94699046d73969af06c68357065af76c4a66e9
MD5 4b8963ad696be6a6b30dea0a7ff69341
SHA1 66cfcd340193e35c84933f13ba49941eb1e1f370
SHA512 808060429cfa6c3c976791f7ca6828e029037a001d32fd5112a240d3b67877020fe5f540f3b2f53d924e9eade843f8ea8da21899b0c840c4d2f6f2e7433377e1
TLSH
T158E0E502459BEA6A0408C00B05EA6A8D92E489583F872B352730C74C52E784EB6B6241
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 7b53eefd916c2470cad116b1e1be0a13eb047a566beb63d76a8ee55ea0b99f94
MD5 b294c6ca4a1e45f1bf76d9ecee294c45
SHA1 49bd1ce8a186c844badbc5749094ffb3dfa80505
SHA512 0a732196917cbb5f6f5418c2054b416fe0c9cb6c82f2e98664d430b3f58e34320acb125edfa1eeb1a6f9e1eaaf5b3bdb1f785dc0650bc3a8161060bc39728424
TLSH
T1EAD0C71241D6D76F0448906B06B5A18DC0754C5C3F473B519B21C44C31C941DF9C7341
MD5 SHA1 SHA512 TLSH

Submit Download

bosix.exe

Path C:\Users\Admin\AppData\Local\Temp\bosix.exe
Size 223KB
SHA256 df955d6f5e017b298266d44ddb2f684c3536703706dd8c7342cf1f1e975455ba
MD5 330206e5de97ccc21ded1f17e194d8f8
SHA1 77542090717edc8dbade34c927b1f9afd9f58314
SHA512 823486f28019ad32e907de3e5d5b6a16563665a099fa215a5dfb95b6c5aa545823a7567c3c91de2766b6edbb8fafd7f8dc52bd07de20648cbc513eeb0858eeea
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3e:unFhSIkAyDgjtS/FZQ
TLSH
T1E924E042AA018888F38C4B316A17FAE449858D3C59D1F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 0e79e09cc878cd71f617ac614a783fcabb70076101ba49c358010c26ac9d204f
MD5 c0173419542fb83e63b7f8fcf0e9db25
SHA1 aa76391c80e7396bd325071a8382c7a3e59b0fa8
SHA512 db060d3be71b11f0aacc5cfa5e68c536ba24ce1a7a42d064c57d93c682870c34bf5173e5e07d2626f97297a0ae402f821ea0feb90d0b8b72aa1e5d75b659727d
TLSH
T12AF09BDD1075B0513652F513E398575733974DD41987AE8C1064B1705E35CDCC458257
MD5 SHA1 SHA512 TLSH

Submit Download

morud.exe

Path C:\Users\Admin\AppData\Local\Temp\morud.exe
Size 593KB
SHA256 012fd0566ff1d5ebe0694f6b3961340a78dc18bbdfbd8ccd9ad383de4a8f0858
MD5 681dcff54637b406e9f09671b070f0bb
SHA1 5515b60b68c68f33247495990a28678031f4df7f
SHA512 1b88711b3642ddd7a7516271018a1065f17049ce574f5633d9683a39bf19b3138f2ec19e0e0fcf9ce77cffe0e6315369bb3d1a948690949e6ce5e4f06801080b
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMY:8MpASIcWYx2U6hAJQnhY
TLSH
T129D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zohool.exe

Path C:\Users\Admin\AppData\Local\Temp\zohool.exe
Size 593KB
SHA256 16515dd3f74638f093fa3edd68767f4771499937e01148aa527ade1be2597417
MD5 8c5f9ac703b9c924b94b0507d9ae202c
SHA1 02ba670ba7e44a8e53d0e98c263d6315fe8a80f6
SHA512 149c4631db3b79a3ddb71fff5b08acabfddc70d828f2eb7ef2753717f91ada6c7322f8f58d652a8b71744cfc1bd670e7bc498d15f7ed2aa8a4a8c4cd52393e68
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMO:8MpASIcWYx2U6hAJQnhO
TLSH
T1FBD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1428-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3208-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3208-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3208-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3596-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3596-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3596-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5808-45-0x0000000000730000-0x00000000007D0000-memory.dmp

Download

memory/5808-55-0x0000000000730000-0x00000000007D0000-memory.dmp

Download

memory/5808-56-0x0000000000730000-0x00000000007D0000-memory.dmp

Download

memory/5808-57-0x0000000000730000-0x00000000007D0000-memory.dmp

Download

memory/5808-58-0x0000000000730000-0x00000000007D0000-memory.dmp

Download

memory/5808-59-0x0000000000730000-0x00000000007D0000-memory.dmp

Download