urelas | 6ce86130a1b3d9b2d1dea654404604abc1cf5841278382cf3fb85f0e4833972d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Size 383KB
Sample260730-2gn6kagm3x
SHA256 6ce86130a1b3d9b2d1dea654404604abc1cf5841278382cf3fb85f0e4833972d
MD5 4caa7c60e0b4fd0a1edc6c8dd4913b43
SHA1 5d0146f05bd16c55f7d642f95633d9224645bc67
SHA512 26cf05be6450aa833512c4f0eeab5f10d93c372be599c641fdbf2e42b4bb486497a2108eae4e3425373881d6ff7d059544ed8b64328cfad84d548b9cc219da71
SSDEEP 6144:S8efQ6QPJGcLbjg08fLsGH+revgLIAP1fXo1Epph:76QPJGcE0rGereYdPca
TLSH
T13D84AE217640D075E3AA033589A6E6F55A946E391394E48FF37C7E7A5A312C36B3320F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
1380	qizog.exe
3932	teyjs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qizog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teyjs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe
3932	teyjs.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1380	4824	2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	88
PID 4824 wrote to memory of 2676	4824	2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	89
PID 1380 wrote to memory of 3932	1380	qizog.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4caa7c60e0b4fd0a1edc6c8dd4913b43_amadey_elex_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\qizog.exe
  "C:\Users\Admin\AppData\Local\Temp\qizog.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\teyjs.exe
    "C:\Users\Admin\AppData\Local\Temp\teyjs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 386B
SHA256 21c646b404fbc924bb5d78da0efb6819b097c6bd680393d966e8c0e7937160e7
MD5 f9ccbdeda99b0473b529ad89ea303bbd
SHA1 289b3dd0bb79912a4aece77ca636058c501938b1
SHA512 fd574c47f53c007c3a385d3d4979ba565b0a97f449790378e53ea6893be3e340f8f914e762dcc2eb9f47ba406cba5f4db169d4cad01d44271283066cd1e20418
TLSH
T183E0920142BFDD7F1428941B1AB9654ED1B4A84C3EC72731A615C35C52D54CEF6E6202
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 264059fa948f43f15db65e43546ab80ac81e103cffcf754b82ae4734c98bd74e
MD5 c523117d0e2e5c6a59fcb21578e272b3
SHA1 3e76dc200c41a92b2db8832ef3be7e9e0d467110
SHA512 0b32add3624e4973612e89d917273692ffa9a1300b103e9ec99aceeb1308795f32ea289484de9a196a10c8dbb2a12101eb59e094b0f68f2e06d0bf0fe2420791
TLSH
T14CF02BDF3091B01B3003F411E364271653430C8D0A83AC880308F2704C7BC3C4914280
MD5 SHA1 SHA512 TLSH

Submit Download

qizog.exe

Path C:\Users\Admin\AppData\Local\Temp\qizog.exe
Size 383KB
SHA256 6cdc3493d092c0adba4fba995434ab915dcd485ff087e7d29d46fd2cd89e9844
MD5 5eb71bf950600234f18b99edceb1e5f4
SHA1 0d03e1c183687d817507bf16877ba9342ddeb348
SHA512 95eac92bf98598c3a0b3afed8e58d7f32be09856b2433aa16f9c3e39b2eef3a083eebfb7714ee33ae83590ad6f063627571322b226945eeb89bc23f78d40b554
SSDEEP 6144:S8efQ6QPJGcLbjg08fLsGH+revgLIAP1fXo1Eppe:76QPJGcE0rGereYdPcp
TLSH
T19784AE217640D075E3AA033589A6E6F55A946E391394E48FF37C7E7A5A312C36B3320F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teyjs.exe

Path C:\Users\Admin\AppData\Local\Temp\teyjs.exe
Size 291KB
SHA256 a085329beb7009d4c00938e24014be11d982cd6940847d11eb3bbfdb9ae46fca
MD5 db7bc5f03c8ebb77e3ae78f2f481e6c3
SHA1 e6d5520fa0623f4f98868bf70b20567c6dc0ec14
SHA512 24e48b34b7130477966085d90ad868fb97956d6ba5ff65f79a3a2d9334ffc12e9755fdd0902eeb57ded4025d8d19812a86f9c59b645c1dbe41a2746575886594
SSDEEP 3072:uyILJKtpYTEbBT6nADhzCf/LBltpUtnJVXe555GK1QlxvHyXKsvW1rBlFHpoER:pILJKtpYwbBjDRMLQtJVmqxvIKsAHpfR
TLSH
T1EC548B213A508076D32A47310696FAF01AA8AE3915D8E54FF7787E392E311D39B7724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-12-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download