urelas | 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6

Analysis

max time kernel
148s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260804-d3fvbavvbx
SHA256 7613bfef948c10cb41f3cdb093989f10879582090c7921676254282a2970c7f6
MD5 0a11d21a08214450a2372b8b6c4e5b27
SHA1 4ce1b6e96c048f5a3e5f9f3b88d50b02d931027d
SHA512 f892a43129f1a9265784b627df7b08ead975100d7eb294ca85cdafa1c5b9313c67262c7aa6fe7c1da02811c52efafd75542248ce6beab88aee4a6076f40bfb68
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtF/:NMvrRb/G8+H/
TLSH
T156168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
3316	kozoc.exe
5544	kixap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4684	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3860	5544	WerFault.exe	92
4664	5544	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kozoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kixap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 3316	5744	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 5744 wrote to memory of 4684	5744	2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe	90
PID 3316 wrote to memory of 5544	3316	kozoc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0a11d21a08214450a2372b8b6c4e5b27_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Users\Admin\AppData\Local\Temp\kozoc.exe
  "C:\Users\Admin\AppData\Local\Temp\kozoc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\kixap.exe
    "C:\Users\Admin\AppData\Local\Temp\kixap.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 256
      4⤵
      Program crash
      PID:3860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 276
      4⤵
      Program crash
      PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5544 -ip 5544
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5544 -ip 5544
1⤵
PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 6ea9b8f911cf8f72c6ba03612d626007f314b4431c41a98e9a1001b1efb77b89
MD5 8c1302f13b5f977b1776a77bf69dae78
SHA1 9d4f2a384dc6a83aadc3155648c19859436482c0
SHA512 ee3364ef2c098bdaeabd08b460eb554e789752e6be1f007b05044721e3d9f44ba56d242a1e6f4eea25599070ce03a57c9bdd0d950bb97ea380842b0325a9b8e7
TLSH
T1F1E0688044DA8A3A0E0CB02F49B471CD80B2A6E9BF632750A334C64E228A80E71CB601
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 8b832e51c068d37c4c7836ac66c8616fdc4ac022b63ebf6c89d37ebbb7e0084b
MD5 eccedcf1c89b81b9dda6846f4d2b3e5f
SHA1 2fc1b40eb6e4bb6a51315289a9bd4a888062c3a7
SHA512 1d765f7abb3d83276a8d38eea04dc19ef2371ef4357e0b2d205bcf4c46a2c845cb827b69839b17791218dfde8c5ad34077284f62ee2591bd75d72db38031d893
TLSH
T138F04CD51456F1693712D512E288479A1BA32D452943CEA40045B2305A35A1D8468265
MD5 SHA1 SHA512 TLSH

Submit Download

kixap.exe

Path C:\Users\Admin\AppData\Local\Temp\kixap.exe
Size 231KB
SHA256 1ee544005dc11e2415df2c79ed590b11758f3b6ed25446b3d9a2663cbe287d16
MD5 5b4adcc62b4c0a6b4ff7d095113fad64
SHA1 f6d469c002d51818ece8b40185fd1d719c41f0c3
SHA512 f3c13702f11681b524e4f2156afbc5966295067941b34c2c5f7ed06595edfc67c74025a65860a82f7d0b68bad8ec5266ae5995e5f4504f9012f4c3ad4e037bef
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpi6:z6r5cTfS/ZPHUWoQISzqJBpi6
TLSH
T15934D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kozoc.exe

Path C:\Users\Admin\AppData\Local\Temp\kozoc.exe
Size 3.9MB
SHA256 04fda3db0d3d26459e8d8b53eeedcc34f1a6686f73d1f23f2fe3739729365845
MD5 bddbd9702bc0faf97cc16c442a013b67
SHA1 3b02f54060f57c03154e1e24d6c4d48cf921f7dc
SHA512 bfca0fde617eeb7ab10a79ca9a926c630f5791ab86f1af087a13e925834ed47f87709e6a9822faf876a612f189302571dbc984ab45f35b2bcdae772588ea1eb0
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFz:NMvrRb/G8+Hz
TLSH
T1F6168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3316-13-0x00000000000B0000-0x00000000004A2000-memory.dmp

Download

memory/3316-18-0x00000000000DB000-0x00000000000DC000-memory.dmp

Download

memory/3316-24-0x00000000000B0000-0x00000000004A2000-memory.dmp

Download

memory/3316-35-0x00000000000B0000-0x00000000004A2000-memory.dmp

Download

memory/5544-33-0x0000000000F30000-0x0000000000FE3000-memory.dmp

Download

memory/5544-36-0x0000000000F30000-0x0000000000FE3000-memory.dmp

Download

memory/5744-22-0x0000000000640000-0x0000000000A32000-memory.dmp

Download

memory/5744-0-0x0000000000640000-0x0000000000A32000-memory.dmp

Download

memory/5744-1-0x000000000066B000-0x000000000066C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads