urelas | e25d122d8646fe41e7bd769eae0c0193471f77aee021af097cab7cb3fcd9fbab

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 21:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 409KB
Sample260719-zxs4caft21
SHA256 e25d122d8646fe41e7bd769eae0c0193471f77aee021af097cab7cb3fcd9fbab
MD5 cf98054b981fa1826626658cdd2caf43
SHA1 481e66f763e1bece284d55fe30b92f9226e3869a
SHA512 ba9f282a244ac03536c4ed6f92f38e45fe4b00cbfca387bba4dfcc31091f6018056a0e986c027f84d1b9a84f44c25e9c448f97451538713044d55bffb2a9dda7
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVI:YIfBoDWoyFbkU6hAJQnaM
TLSH
T14F94BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
820	luqes.exe
4880	dobeho.exe
3488	paygu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3736	cmd.exe
4732	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dobeho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	paygu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	luqes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe
3488	paygu.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 820	2696	2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 2696 wrote to memory of 3736	2696	2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 820 wrote to memory of 4880	820	luqes.exe	92
PID 4880 wrote to memory of 3488	4880	dobeho.exe	94
PID 4880 wrote to memory of 4732	4880	dobeho.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_cf98054b981fa1826626658cdd2caf43_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\luqes.exe
  "C:\Users\Admin\AppData\Local\Temp\luqes.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Users\Admin\AppData\Local\Temp\dobeho.exe
    "C:\Users\Admin\AppData\Local\Temp\dobeho.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\paygu.exe
      "C:\Users\Admin\AppData\Local\Temp\paygu.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 ebfaa7e4d20bead1d1ae335bfef04ec6a4265f4d09af97713b14b7cbc8d74161
MD5 4751df80553ad76dc16b5856ff0eee72
SHA1 ebc99e0fee950c2ed40abb8bc0c499ffcaa579a3
SHA512 def8e2668d2070e154faf5aea7a8f07833e71d710da9cde5ec29805d35b02836d04201ebafa406906b3303290601c25ca62aa2b0a68e3909ff9c827995c9c15c
TLSH
T1D7E09B01019FEA6B030DC01F42EF658EC1949D193EC72B757721C65C53D58BFB8A3212
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 d6186ea55afe823ee713dff5e2e608f1a2814c6343e79988575ea7f984e9960c
MD5 d643e0b70fe70c5fa434e5588c7601c0
SHA1 16c2608224f634f7ac2c522dab18c03a64bd0216
SHA512 87c5be6d0088c69fc7e69cbd15454e6efcb2c0c33a0ce52d467b2e5921c4239ac3bb244ea08e67b4d7779f75dd61058b762bcc3e336e5eda38446a91ecb93f2a
TLSH
T1F8D0C75242D6D75F044C902F46F5A58DC0755D5C3F4B3B11A729C44C21C541DF9D7341
MD5 SHA1 SHA512 TLSH

Submit Download

dobeho.exe

Path C:\Users\Admin\AppData\Local\Temp\dobeho.exe
Size 410KB
SHA256 aa4310dacce38c5d7323d48e1f1382d4a34de6a0bd833be16c3967fb17ee8ae6
MD5 4e1591de63680043701d8330e808ad57
SHA1 38094d4032b6bf6fdab0e21ca82735cf2026b81c
SHA512 58d54b53d101d28c4c00ed323985c421f730cacd2cc4dba1b9e629acc91d624662e8285148540b248fc984afd748c5cd8d9d03003e632fd5092f2a42bb36850a
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVU:YIfBoDWoyFbkU6hAJQna4
TLSH
T19594BE253540C436F3290B354456EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 dd8cf01025b09c901f7fccc19f29241ca7084c64adf06d989ed356c307c86118
MD5 9690e01fb995549a5183f5f2ec4b6124
SHA1 90c6ec1f3ec13f3f3ec9fc79108b4cc9a9dd7437
SHA512 9c18e6e08ff573397834fe25419c33b05f0aa199a09ef9ab06eb8ef8904320d47ad089a740b3351c58a5d4fd049228977bb17613fca053684052883a2ecab2b3
TLSH
T19EF09BE53069F0693615D533C78437D417A31DD61E87DD584349B2F04D36D5C88543D5
MD5 SHA1 SHA512 TLSH

Submit Download

luqes.exe

Path C:\Users\Admin\AppData\Local\Temp\luqes.exe
Size 410KB
SHA256 cb32286d95f68b85239140e1098ab7cf9269f5b962752ae490025b1e482c0801
MD5 88eac74ca3c97936c0d27be5c6e2095d
SHA1 2a658912be68672741d25ce8c5a6d3ee485bc5f2
SHA512 8369c6820d554d37058d802ef1a0009d9bb206ecb9e3c7045a1303bb15c499911361dd65fef44e33a50a1a3ff0743a9e20feaf703fbc1dbdd1a86eb06d7ff628
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVm:YIfBoDWoyFbkU6hAJQna6
TLSH
T14194BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

paygu.exe

Path C:\Users\Admin\AppData\Local\Temp\paygu.exe
Size 223KB
SHA256 df955d6f5e017b298266d44ddb2f684c3536703706dd8c7342cf1f1e975455ba
MD5 330206e5de97ccc21ded1f17e194d8f8
SHA1 77542090717edc8dbade34c927b1f9afd9f58314
SHA512 823486f28019ad32e907de3e5d5b6a16563665a099fa215a5dfb95b6c5aa545823a7567c3c91de2766b6edbb8fafd7f8dc52bd07de20648cbc513eeb0858eeea
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3e:unFhSIkAyDgjtS/FZQ
TLSH
T1E924E042AA018888F38C4B316A17FAE449858D3C59D1F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-18-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/820-31-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2696-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/2696-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/2696-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3488-55-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/3488-45-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/3488-56-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/3488-57-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/3488-58-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/3488-59-0x00000000001F0000-0x0000000000290000-memory.dmp

Download

memory/4880-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-53-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download