urelas | 57d3836d1f90eed5bd08a0a0bce03e257f9074d13b48483c7187341adddf2244

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 402KB
Sample260720-apsp6scv6x
SHA256 57d3836d1f90eed5bd08a0a0bce03e257f9074d13b48483c7187341adddf2244
MD5 f05a445d7d2f6d327235f903d875af85
SHA1 6a5eb1003062602f4fe8579fdebfb72dc20cf484
SHA512 460704bc66c786bf49260359e77d984855f09a36267ee177f39fd7a2194e1d89e9409fda08370f3856741cd7b750d78cbf31930afe9fe07eb22b64042a093e94
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvE1:yIfBoDWoyFboU6hAJQnr9
TLSH
T1AD94BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3536	seebp.exe
4528	noovha.exe
1980	jopen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5136	cmd.exe
4620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	seebp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noovha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jopen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe
1980	jopen.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3536	4468	2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4468 wrote to memory of 5136	4468	2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 3536 wrote to memory of 4528	3536	seebp.exe	92
PID 4528 wrote to memory of 1980	4528	noovha.exe	94
PID 4528 wrote to memory of 4620	4528	noovha.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f05a445d7d2f6d327235f903d875af85_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\seebp.exe
  "C:\Users\Admin\AppData\Local\Temp\seebp.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\noovha.exe
    "C:\Users\Admin\AppData\Local\Temp\noovha.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\jopen.exe
      "C:\Users\Admin\AppData\Local\Temp\jopen.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 86966f4ac303abe67cc8b75c7567cb389afb24aaadb743299ecf103a251f402c
MD5 8a1a78e8ec47bfd0b01c88ff859f075f
SHA1 8a90735c51197425116b737542cdfba1e781cf5d
SHA512 8f73d3912838f9390699961876c93af2ff789fa669e4b7063fbf030d3f1911dc5ea3effec37de23867669e070b6b05658727d901a3f6262cef86a6874a4a5bbf
TLSH
T1CAE0E50102ABDD2E090CC01B05B9F68DC2E565592FC73B717B10CA0C52D685EB4A2201
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 b06c46167b8602195f5e6974db66470ca437dd90593ace5cbc1b44506634dbb2
MD5 43a050e340ec13331a2b4f5841d0890f
SHA1 ed36c9b8032af89e4709fb0ff156c48134ec0936
SHA512 fba7908f21628b3bb90126dca4c9704e0978ae9abfb51a020d74835215980ed799925e0167fe2d1953a7b8f2ea3c510ab6e6c2cb5795f31678f8acaa7fddedb5
TLSH
T1F8D0C71141D7D79F0449902B46B6E18DC0794C9C3F473B11A722C44C61C241DF9C7342
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 b2b2e2d4348c5f2c6ec72b57ba7a123cc3eb6d9674f55e726900bc56eed3fed8
MD5 34aa7dffe9ba610f1e918353b997fbfb
SHA1 0a96c6928ba07b89ffec4b21957d434cc39cd4f5
SHA512 b5477408391402229d0efcf65cb71d2ba073bb9400558a3daec0c1a55b76c1e7e8f01e740fa1b1eed79d82a32ac88e0097ca846c7b89fe6ba13019b660ff4c8b
TLSH
T1EDF09BD61175D0673612F312D795679D37E71DCD1A575CC8004472719D36C7CC544355
MD5 SHA1 SHA512 TLSH

Submit Download

jopen.exe

Path C:\Users\Admin\AppData\Local\Temp\jopen.exe
Size 223KB
SHA256 dabebfcec06fc8f1511f33d36aefbe21178c1d23844c226310d398f66ab523e7
MD5 772ee640c826c5eb6fc6e4d9ca50c7c6
SHA1 6e3b6c839d54d8e0700c75ef1d0d44d816790d17
SHA512 84798e3bbdcddbd2055fa4d53db0fe28b34abeaaecbaf7c79ccf4d30c33e7b384df9d8e3f397727ca7e81895840d3403ed7cac4ce13bf43225e79c7883ff07ab
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3g:unFhSIkAyDgjtS/FZK
TLSH
T14524E042AA018888F34C4B316A17FAE449958D3C59D1F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

noovha.exe

Path C:\Users\Admin\AppData\Local\Temp\noovha.exe
Size 402KB
SHA256 0e9507e009f72da567d58953abe33fb86ce2bd4ad33096f98b22b78f90488766
MD5 3ac012aafaa610e4d9e602c1e89352c8
SHA1 8ecea944999da969e221819a6d15c00f2d486333
SHA512 e9e173aaf7974656cdf2b3ccf198ac58818bebbf7562fc0da81fe3d85ea918437b685a15c08412ece8be095d923816ebb79c15d7a57d377d3cc5a8330d5c0013
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEO:yIfBoDWoyFboU6hAJQnrW
TLSH
T1C094BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

seebp.exe

Path C:\Users\Admin\AppData\Local\Temp\seebp.exe
Size 402KB
SHA256 de1265d6450f8f4826f61b08d6339375a66f40d560c22bca7a5a4d0b504a4e62
MD5 534fbea0234c8e726935ceb08047cf1c
SHA1 a588076afd88cc7c6f5e31b89880169fb6fa213f
SHA512 3dad29835749c1e14e92f2d88ce4333882a08b03b71e975cfffc2df261a110d2b000c3bf9db646f7aea420587a413157d702a169cc828d49c54b214d115d3370
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEB:yIfBoDWoyFboU6hAJQnrJ
TLSH
T11194BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1980-55-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/1980-56-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/1980-59-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/1980-58-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/1980-44-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/1980-57-0x0000000000270000-0x0000000000310000-memory.dmp

Download

memory/3536-31-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3536-14-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4468-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4468-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4468-21-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4528-52-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4528-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4528-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download