urelas | fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260718-1ffblags4v
SHA256 fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894
MD5 a405440bb8cbde599b7b39b25d2c9087
SHA1 f2b504f081ff33ab2111d82f792352c938b18caa
SHA512 fbc9586d4453f6b5e376f303a0fe848e85043800b2eb7b66384bcd48a9626e6b2c264f39cbc96002ad3c8e50b12448d4fce46dfaeafe2dfdb4457d91dceae834
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFb:NMvrRb/G8+Hb
TLSH
T19D168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4388	habed.exe
3572	gaifi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3596	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3292	3572	WerFault.exe	93
1132	3572	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaifi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	habed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 4388	944	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 944 wrote to memory of 3596	944	2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe	90
PID 4388 wrote to memory of 3572	4388	habed.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a405440bb8cbde599b7b39b25d2c9087_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\habed.exe
  "C:\Users\Admin\AppData\Local\Temp\habed.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\gaifi.exe
    "C:\Users\Admin\AppData\Local\Temp\gaifi.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 256
      4⤵
      Program crash
      PID:3292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 264
      4⤵
      Program crash
      PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3572 -ip 3572
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3572 -ip 3572
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 64acee2a6a81d83f94d7afd0531f071ef90ecaffabfd3a928f079b481bbcf0e6
MD5 5a92b46a2a26a78296e6685c38b98297
SHA1 51bc12edcad2b99352b5865e268814c2a3cc3f2d
SHA512 06b675efbdabbd41fe833a22b843b88c4aced7380d91ad33251b665e6d1a6a9178908a2931aec0c15f2e313ca19639b225957940c58617db5a1c72abc7b9daa5
TLSH
T180E0D801585A9A6D050CE02F0DEA7A8CC06494D9BE4637149735CA8D22EE84E76D6622
MD5 SHA1 SHA512 TLSH

Submit Download

gaifi.exe

Path C:\Users\Admin\AppData\Local\Temp\gaifi.exe
Size 231KB
SHA256 c5258fa83926bb04c7a66250fc0c5e6a3e69d560b0803afba8be52b896365d56
MD5 3b4515210739aa1635433b0369488ad9
SHA1 62e3ff4c6d90d1568a4393d569c5cf7bafc21c02
SHA512 5a0a9e15fda8380934bd0791f36fe075cc15e90781be4304f75398e65647b57c137081d03bd99b810d1d3ac1d81e06de29da6390fefc31a3c60be5d6c8c948df
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiZ:z6r5cTfS/ZPHUWoQISzqJBpiZ
TLSH
T1F034D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 2a125c676d10b1e973a329e3d03c238459f8d75a589f13113a364502a1bca2c3
MD5 3e31d04b52ccb854f54b49097cb423e4
SHA1 cf4b4da50dbaf337ea3b39927addd32b5fa21784
SHA512 4c40206a194f8d60b0a2a2e2e4534834a8eee52613ef6a1d4eab966642a887f2e3c355a90dc9f135a3972d8c37b1e502b4f3a523b1b889858c1c9f077e8517d9
TLSH
T11DF09BD92065F0653B15E612F3C50F9527931DDC15C7ACD54045F1B04F75D5C44943D7
MD5 SHA1 SHA512 TLSH

Submit Download

habed.exe

Path C:\Users\Admin\AppData\Local\Temp\habed.exe
Size 3.9MB
SHA256 d3a899f3afe9b6820e953c853819101351aa83044737e468fcc0b75fbf01c648
MD5 e56d002491add91e436bfd3ae74a3427
SHA1 e2798de9b2ed8161f410a8c57d361094f968f50e
SHA512 f97dfd390da2eb9c678bdcd4e5cd7f828c125efad988ab0f39bffe17c2e4e96c23f1ba90f0204d0670d1175edca6093e2227fa1d30bb5e57893b04b2557897d8
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFH:NMvrRb/G8+HH
TLSH
T183168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-21-0x0000000000520000-0x0000000000912000-memory.dmp

Download

memory/944-0-0x0000000000520000-0x0000000000912000-memory.dmp

Download

memory/944-1-0x000000000054B000-0x000000000054C000-memory.dmp

Download

memory/3572-34-0x0000000000300000-0x00000000003B3000-memory.dmp

Download

memory/3572-38-0x0000000000300000-0x00000000003B3000-memory.dmp

Download

memory/4388-12-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

memory/4388-14-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

memory/4388-24-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

memory/4388-25-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

memory/4388-36-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

memory/4388-37-0x00000000003D0000-0x00000000007C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads