urelas | 5c37f75ff1ce84c5400c9e6cbeb5b69ba135d06d5dca9073076740c45a2e2655

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 355KB
Sample260802-paz82aselb
SHA256 5c37f75ff1ce84c5400c9e6cbeb5b69ba135d06d5dca9073076740c45a2e2655
MD5 1792ebd98523276470209df16873060d
SHA1 78e71a7a1bb9e4fbdd697fed3ceb5e38f16d8665
SHA512 5defa196d04f8f92423380a0d3965d8a02ea267865a12cb1e095bc55fa30fe19933e35d4bcbd3841617fdef81d244835b12d804c27b4e6064312fb961e74983c
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzX:wd7rpL43btmQ58Z27zw3eZzX
TLSH
T152749D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4620	irbob.exe
1084	ranusu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2228	cmd.exe
5992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irbob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ranusu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4620	6112	2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 6112 wrote to memory of 2228	6112	2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4620 wrote to memory of 1084	4620	irbob.exe	92
PID 1084 wrote to memory of 5992	1084	ranusu.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_1792ebd98523276470209df16873060d_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Local\Temp\irbob.exe
  "C:\Users\Admin\AppData\Local\Temp\irbob.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\ranusu.exe
    "C:\Users\Admin\AppData\Local\Temp\ranusu.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 45049beabca1f46970d19c63fd5a12b1ea9c1edec986453591b14824f475f901
MD5 97a2727fdc45a6c1e7e6e4e58c402205
SHA1 84382a55bb6daa86de29b8e266d0a6c888e128e3
SHA512 833f45f51fa63c7701b2738fe4272780af892799a792481787dfbe383616f7d6340106e46cc02b9a0a958961f726f4bd980552eec19e0f47fe30d8462c5d4233
TLSH
T1B6E0D80105EFDB6A080ED01F0FF96C4EC15676A97E973764B712C54C22D645EF4D2213
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 4e37049e9eca3819b5428044a6451710c490922e0529081d44716a8939e1041b
MD5 a25e42dd39805a761caf2fdc5c06e684
SHA1 60a06e5fe5fb5df87e9d99c4f651227c1507f288
SHA512 a9250521585bc42e0b3b708070574ab0156722e0c3a82929a8b630c5ee924d8bcac5dccaf99fdc2c213f5aa85fa8c6501b90ac0df9273ba0eea6c05df5461957
TLSH
T19ED09E114296E65A444C942B06E6658DC065485C3F862B119621C45C61C141FF5D7351
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ef66f6e751054c67baea630577c79f8b790331b7c177e7bcc5ceeb95e2fc4ad2
MD5 676008087a644f2420ab8cabc37ba771
SHA1 df4c2e7ba89ffa9319adbba668a8f02c30630e62
SHA512 e58e68bc7db011032d30ac2000b92ab8cda580eb7426de3ecc4a8c30b0b6c1bd4f8a7face079aa1a4aed97a2e9a5c57d323596c253a112cdee7533292152ad1b
TLSH
T1CCF04CDA3091B0697A12B705D294AB5227931D8869439DD9016573305DB985CD484356
MD5 SHA1 SHA512 TLSH

Submit Download

irbob.exe

Path C:\Users\Admin\AppData\Local\Temp\irbob.exe
Size 355KB
SHA256 78a04eec4d9c4129eec1e7d33c41108256f7fce32c8cebdda8d224997851e062
MD5 4fb708cbab375d603156a202cfe07de4
SHA1 50e4c6fb797dc57cdfda25ba03fa7105f80942d1
SHA512 5a77d97e039273b77e7d942250c2bf8362a6e206f5a280848ae7c7c836c1bf494e783112b45b3752b3052bb4b21f676fb6c49b4ad977f83a8dafd0bb7285d976
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzR:wd7rpL43btmQ58Z27zw3eZzR
TLSH
T1DF748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1084-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1084-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4620-17-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4620-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/6112-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/6112-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/6112-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads