urelas | 0812449e48b8fc0f12824a881359355b51a1977358c97d6094e1a73618f08c28

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 402KB
Sample260728-d8js6axyh1
SHA256 0812449e48b8fc0f12824a881359355b51a1977358c97d6094e1a73618f08c28
MD5 eaed761717fdd1b25e2e3bd8432e5c49
SHA1 d400367b32e4acb63a35bd34c18e6cdd25de1aac
SHA512 f1581b8ae4050bffd51fdcafeb948c675d3b9862a2e926c7261405f8545c469ec2a6f444a8069ba84ed03ebd0c22e722081f345f3cc950e401d17189fe28bfa1
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvE9:yIfBoDWoyFboU6hAJQnrl
TLSH
T16B94BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
6108	muvyv.exe
4792	zaynny.exe
1792	xaepv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
504	cmd.exe
6180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	muvyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zaynny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xaepv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe
1792	xaepv.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 6108	6856	2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 6856 wrote to memory of 504	6856	2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 6108 wrote to memory of 4792	6108	muvyv.exe	93
PID 4792 wrote to memory of 1792	4792	zaynny.exe	95
PID 4792 wrote to memory of 6180	4792	zaynny.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_eaed761717fdd1b25e2e3bd8432e5c49_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Users\Admin\AppData\Local\Temp\muvyv.exe
  "C:\Users\Admin\AppData\Local\Temp\muvyv.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Users\Admin\AppData\Local\Temp\zaynny.exe
    "C:\Users\Admin\AppData\Local\Temp\zaynny.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\xaepv.exe
      "C:\Users\Admin\AppData\Local\Temp\xaepv.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:6180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 abf8d12d991e1e0722f88adcc7fdd2b49474b77617d19ce504783dabffa77fff
MD5 30ea39864f4a1568175c50b8d383a1ac
SHA1 6dc0611b6eddbe4f08c284e914280129c8509a7e
SHA512 f246469dd98c4fb9d6ace1006e0c9ec4aee2ddb53d6013d31f05f4417432bcad6f8ccc4c8777ef9706389ca46152abf36c8e0247e68347a7be71575772df8c58
TLSH
T111E0E50204FFDA2A0808D00F42AD75CEC1A45D182FC73F2132118B1C51E58DEF1E2201
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 223dae2dd16ac7df249473ecd9b9120c48936d2366bdf859cb874295c29d5742
MD5 69cda87baea3f9638a4c95ad35c10a15
SHA1 8b2db1afbba091ce7df7107e7535f6afcd7fc0da
SHA512 2fc987af7b7567d47dcf147f849aaccea44b95df0edf022c6ed198ad9a743fef5c119671fbae60c5780596094506bbe283660dbf35cb16719d7c3508ba95741e
TLSH
T168D0C91181DADBAE0848906B0AB5628DD1798CAC3F8B3B11E725C85C62C281EF6C7382
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c46f70daa975f436303d4209d916985883e2c8da51a612e66e46c91c2bd59ab3
MD5 869cb5309f25275ea2d93fc94b82f3ec
SHA1 18879ede20b89cb2a89816f79b32dce5c543c935
SHA512 ded2e3f06812d3fd2ede28faa619c6f3761061edb96661974c281f918164e706018eaa58a3ec1abe28e013262bf0713fb5582b20876a7dc9c2caedec6def3f26
TLSH
T1ABF09BD56051B0753611F732F794375457931DCC37878D84454471F09A77CFC44546A5
MD5 SHA1 SHA512 TLSH

Submit Download

muvyv.exe

Path C:\Users\Admin\AppData\Local\Temp\muvyv.exe
Size 402KB
SHA256 8142ef795ff6044854d4a0b47437cbb2c04ef56830e30a86fc622dcad629f124
MD5 5f214c2ec9457052dc4b98427b37a06d
SHA1 87c9dedeca37b0b8c36f9e1c422302e4f701ba61
SHA512 ecc288b9468d3494b82a732b342590b285f79e8eff6a257a105aeb328509e8a96a9991303602b5d34a19b84ac9ad7bdde94e06b22b7cdd40cfba29fff4aa6978
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvEF:yIfBoDWoyFboU6hAJQnrd
TLSH
T12694BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xaepv.exe

Path C:\Users\Admin\AppData\Local\Temp\xaepv.exe
Size 223KB
SHA256 6f23320deb7b3da3d3eba2265e52b0f517e41513c8dedb3f67d6fa998a994da7
MD5 250a36a807340abfcc3a918fe5626814
SHA1 d987ae7b97e43104ac3f0acb1628145e8e06f550
SHA512 1e214350586cf7df7b0d3b5ddbe13448f027d4a50d753ee8556801e178ae3220684587aab42cedc640866450431c4be97db36598706265e5f3d3f084fa999930
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p35:unFhSIkAyDgjtS/FZT
TLSH
T18D24E042AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zaynny.exe

Path C:\Users\Admin\AppData\Local\Temp\zaynny.exe
Size 402KB
SHA256 67e6515152dd54eba3e1e72f8d7ac1786494bc2b39235febf86bbde84a0f3b58
MD5 76c970d3b7dc7ff7fa134e4eaaaee0e2
SHA1 e9579ad8783ce96f2cfe4dac5cd5a4c433a3e7fe
SHA512 aff8e92e678beca1f08d7c5b0058b959a1e4b3519f825b2834e6d5b104d262709e9e179f9b9eb0d36ff7914bfccee14f1a84c06162501f9b0f76310bcab1c137
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvE+:yIfBoDWoyFboU6hAJQnrW
TLSH
T1C494BD253140C436F32A0B354456EAB109A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-55-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1792-44-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1792-59-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1792-58-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1792-57-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1792-56-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/4792-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4792-53-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4792-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6108-14-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6108-31-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6856-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/6856-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6856-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download