urelas | 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260804-d3fvbavvbx
SHA256 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6
MD5 0a11d21a08214450a2372b8b6c4e5b27
SHA1 4ce1b6e96c048f5a3e5f9f3b88d50b02d931027d
SHA512 f892a43129f1a9265784b627df7b08ead975100d7eb294ca85cdafa1c5b9313c67262c7aa6fe7c1da02811c52efafd75542248ce6beab88aee4a6076f40bfb68
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtF/:NMvrRb/G8+H/
TLSH
T156168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	zivob.exe

Executes dropped EXE 2 IoCs

pid	Process
2084	zivob.exe
2568	vyizm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2576	2568	WerFault.exe	102
5032	2568	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vyizm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zivob.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2084	5004	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe	90
PID 5004 wrote to memory of 4288	5004	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe	91
PID 2084 wrote to memory of 2568	2084	zivob.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\zivob.exe
  "C:\Users\Admin\AppData\Local\Temp\zivob.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\vyizm.exe
    "C:\Users\Admin\AppData\Local\Temp\vyizm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 216
      4⤵
      Program crash
      PID:2576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 236
      4⤵
      Program crash
      PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2568 -ip 2568
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2568 -ip 2568
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 6ea9b8f911cf8f72c6ba03612d626007f314b4431c41a98e9a1001b1efb77b89
MD5 8c1302f13b5f977b1776a77bf69dae78
SHA1 9d4f2a384dc6a83aadc3155648c19859436482c0
SHA512 ee3364ef2c098bdaeabd08b460eb554e789752e6be1f007b05044721e3d9f44ba56d242a1e6f4eea25599070ce03a57c9bdd0d950bb97ea380842b0325a9b8e7
TLSH
T1F1E0688044DA8A3A0E0CB02F49B471CD80B2A6E9BF632750A334C64E228A80E71CB601
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f5917211eebae71f70e30034fecceb8f7b9ab17e053f8cc905e2fca1a96296a2
MD5 4c537b6b365210a8bc11770bd64a14d3
SHA1 c14085f3d078f96142d5b6691c643efca306c401
SHA512 d5c15d417c64f302a0de871ef705bd2852743e0ecd3e679a19f323a27ffca5148d61f46e1a98be3801ee825b4df9a97e57bc5ff450ace16972dff13d975e9135
TLSH
T16DF04CDA24A5B0763611B633E2E46B9123930D586E47DC9C010475B44DB5CDC4984B15
MD5 SHA1 SHA512 TLSH

Submit Download

vyizm.exe

Path C:\Users\Admin\AppData\Local\Temp\vyizm.exe
Size 231KB
SHA256 420c88f80ddb786e3d7975f44fceea7fb43e753917ff1fc99c3fd91cf60f75fc
MD5 44a72d6b6d1e814b6360e251378cf1ec
SHA1 99e67533e0af7270f4ee2ba19c129e5876618713
SHA512 f5da2b22686f80a5748a0d2e0bc972e88098d31b8d304b3f73052450ee224b561d26ef6b98594f888bd5111b357df9c174ad43354d5a2e9b593fc58c27f38617
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiY:z6r5cTfS/ZPHUWoQISzqJBpiY
TLSH
T1FC34E06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zivob.exe

Path C:\Users\Admin\AppData\Local\Temp\zivob.exe
Size 3.9MB
SHA256 4b1251ae10d868f15466bcbf4a5b6c85e88c913e770ed8224a74dac1f9bf0a12
MD5 e80c6a3c76b3dc4382f17366f6ebc4fe
SHA1 ffc789ca27b657d3bc71b46f9ffc8d270163c859
SHA512 101db3bb6e1215e3b935186fa85a65500145412c35fbb22230fbe36a8e4eec9feb2c604d7aafe06d2b36ecb13d65acda767782d9e206e9c44d62bc9cf64a5b9a
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFs:NMvrRb/G8+Hs
TLSH
T1B3168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2084-14-0x0000000000C7B000-0x0000000000C7C000-memory.dmp

Download

memory/2084-13-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

memory/2084-19-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

memory/2084-29-0x0000000000C50000-0x0000000001042000-memory.dmp

Download

memory/2568-28-0x0000000000390000-0x0000000000443000-memory.dmp

Download

memory/2568-30-0x0000000000390000-0x0000000000443000-memory.dmp

Download

memory/5004-16-0x0000000000210000-0x0000000000602000-memory.dmp

Download

memory/5004-1-0x000000000023B000-0x000000000023C000-memory.dmp

Download

memory/5004-0-0x0000000000210000-0x0000000000602000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads