urelas | fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260718-1ffblags4v
SHA256 fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894
MD5 a405440bb8cbde599b7b39b25d2c9087
SHA1 f2b504f081ff33ab2111d82f792352c938b18caa
SHA512 fbc9586d4453f6b5e376f303a0fe848e85043800b2eb7b66384bcd48a9626e6b2c264f39cbc96002ad3c8e50b12448d4fce46dfaeafe2dfdb4457d91dceae834
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFb:NMvrRb/G8+Hb
TLSH
T19D168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	azpog.exe

Executes dropped EXE 2 IoCs

pid	Process
3192	azpog.exe
3392	oxsop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4436	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3152	3392	WerFault.exe	102
3480	3392	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azpog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oxsop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 3192	736	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe	88
PID 736 wrote to memory of 4436	736	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 3192 wrote to memory of 3392	3192	azpog.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\azpog.exe
  "C:\Users\Admin\AppData\Local\Temp\azpog.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\oxsop.exe
    "C:\Users\Admin\AppData\Local\Temp\oxsop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 216
      4⤵
      Program crash
      PID:3152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 236
      4⤵
      Program crash
      PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3392 -ip 3392
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3392 -ip 3392
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 64acee2a6a81d83f94d7afd0531f071ef90ecaffabfd3a928f079b481bbcf0e6
MD5 5a92b46a2a26a78296e6685c38b98297
SHA1 51bc12edcad2b99352b5865e268814c2a3cc3f2d
SHA512 06b675efbdabbd41fe833a22b843b88c4aced7380d91ad33251b665e6d1a6a9178908a2931aec0c15f2e313ca19639b225957940c58617db5a1c72abc7b9daa5
TLSH
T180E0D801585A9A6D050CE02F0DEA7A8CC06494D9BE4637149735CA8D22EE84E76D6622
MD5 SHA1 SHA512 TLSH

Submit Download

azpog.exe

Path C:\Users\Admin\AppData\Local\Temp\azpog.exe
Size 3.9MB
SHA256 f67678f6861c5800f46ed5257243d318384755d94873b39faba1f25944e6b770
MD5 ae3a9b93cc893cf42b9f303b589839bb
SHA1 b615757f1ef4431b0dfc1a1af151eecd75a8d167
SHA512 d5867bf50856fb6668bcc88d778ba6de4f288f3340ba289b5ce660406194499b7705e8416fbb79e625b17e537cbd2b52321eb30c485ab08b1f5a3e90ce1bad89
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFY:NMvrRb/G8+HY
TLSH
T158168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b69d6041cb94fc04493154d641dab839b3c59477081c21b99143bba085207eb5
MD5 e405225fc4e7a87e2806e3adde657ed5
SHA1 f00e54fbb133f0328201961980b9ed3d4e180b9d
SHA512 b492d44aafb15858c8d68a535d02650ef28236ee098f27505b393482f14e9a665aebaa957a7defa75f3660f05346bdab533519d4c168e444d23be465cf5f58b1
TLSH
T105F04CE52255F0413611F523D7955BD157B31D9D2987CC988109B3308A78E5C84942D6
MD5 SHA1 SHA512 TLSH

Submit Download

oxsop.exe

Path C:\Users\Admin\AppData\Local\Temp\oxsop.exe
Size 231KB
SHA256 9166a6ed4bea4276253c6803a4bd139570e36ba5db1e556d5a323267dbf17265
MD5 a069f9bd94591b8d1e3e6546e64d44f5
SHA1 58f34344ffded02e96bec10b5e397b602d5f5584
SHA512 2add5f37b97f97e60e9d69a07d302c5dcb613493d803adcd11a71c054d141281fbc9003acb67105de047446e0b6fe11b9f5d0b75dc598e07c997a90ef8a9566a
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiK:z6r5cTfS/ZPHUWoQISzqJBpiK
TLSH
T1F334D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-1-0x00000000003DB000-0x00000000003DC000-memory.dmp

Download

memory/736-0-0x00000000003B0000-0x00000000007A2000-memory.dmp

Download

memory/736-15-0x00000000003B0000-0x00000000007A2000-memory.dmp

Download

memory/3192-13-0x0000000000B80000-0x0000000000F72000-memory.dmp

Download

memory/3192-16-0x0000000000BAB000-0x0000000000BAC000-memory.dmp

Download

memory/3192-19-0x0000000000B80000-0x0000000000F72000-memory.dmp

Download

memory/3192-29-0x0000000000B80000-0x0000000000F72000-memory.dmp

Download

memory/3392-28-0x0000000000D50000-0x0000000000E03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads