urelas | 826b70b83bd57a1c506e4fc9c984001c2298fe69734b5a8cbd9862a0331b8d19

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 401KB
Sample260804-ttj4davbqa
SHA256 826b70b83bd57a1c506e4fc9c984001c2298fe69734b5a8cbd9862a0331b8d19
MD5 2bddf880828f9f733d4e16e95dff17a7
SHA1 2b3150181f604cf861f540b3d9ae778a1d951260
SHA512 c28d1a14ea410c3dcd8572027b3ecdc95c63fc74d371f0f5f86fb244755925f417309ad61b63c587320a8e697fe66e1a775e489a26c59c98b10379468b583a2b
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvd:yIfBoDWoyFboU6hAJQnro
TLSH
T14794BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3784	dotig.exe
1060	ulquhy.exe
1936	ippap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5704	cmd.exe
5856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulquhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ippap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe
1936	ippap.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3784	2688	2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 2688 wrote to memory of 5704	2688	2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 3784 wrote to memory of 1060	3784	dotig.exe	92
PID 1060 wrote to memory of 1936	1060	ulquhy.exe	94
PID 1060 wrote to memory of 5856	1060	ulquhy.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2bddf880828f9f733d4e16e95dff17a7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\dotig.exe
  "C:\Users\Admin\AppData\Local\Temp\dotig.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Users\Admin\AppData\Local\Temp\ulquhy.exe
    "C:\Users\Admin\AppData\Local\Temp\ulquhy.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\ippap.exe
      "C:\Users\Admin\AppData\Local\Temp\ippap.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 726610391e63a4ec594240dd6474650e628e7687f3c1c9cc0a971af39fcf7d6c
MD5 384418124e3aac91f41bcceef1f8de12
SHA1 a80f091c4533584699c811b57d396d26fb65bb05
SHA512 cfb76a5311ea72dd82d40ccc082625481221584809e82a5f0bc0e14dd81e7cd6500451647079f61f4740ba1e530af685e4fda7b0fcde811108c5cdad0facc397
TLSH
T1B2E02B0042FFEABB081CE42F66A4A64D9264D5543FC72BB17320864C91E545EB5A7222
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 62dc25c6a037604904507c9b5c6e4dc28cc111f85a16f34997274b1c1487db98
MD5 fd1101e14d4bc515ee8a62881ef7ad95
SHA1 3ae1499cb80692d9d415dc83b086d2dcd2f1f82b
SHA512 016e1560cf36aed8ee4016f5471fee847b6082ee44948a87276fd34e24e076700ecd43a958ba0ef6b61780c13e48029ae4034807680f95a907d6d745be1506c6
TLSH
T1BAD0C75181E6D75F444CD02B06B9618DC0754C9C3F4F3B11A725C44C21C181DF9C7341
MD5 SHA1 SHA512 TLSH

Submit Download

dotig.exe

Path C:\Users\Admin\AppData\Local\Temp\dotig.exe
Size 401KB
SHA256 9dd5b1cfe74166d3dbda2f2f1ad719e4bb3b1afb4bb9b57b17647617957fcefa
MD5 e32f301b9179cd0bcc11a643897e8512
SHA1 3a4bb032b2a590b82ddd6a5f8095ae1bd3afbd56
SHA512 435f854a67c3272ad9ce1edca7d395b393b360aba19c5f7aafc088f95b899a5079b3000d9739d2eef03c6be1001a6a8fa76aebfd92527eb1864f6dece4a46675
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvu:yIfBoDWoyFboU6hAJQnrZ
TLSH
T1E794BD253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a4f94bc7b4a4f29240f8ffaa107c94143a4dfcd7b79285c5458f2786c7d19cdf
MD5 cfb43534d00bc3e3174f3b08afab925a
SHA1 6cb7291160f7bb5619e67d18cceb02e43c9a569b
SHA512 7401b5f1df50f0163f80f38f976a54078ffc0c96fcd98858874d3065c3dca87f090d341a8ce537e18d6a8f8ab257be3a9fc537bdb17365d76abb45bbe1d981aa
TLSH
T162F09BD51091B0673611E732D7943F5223E31FD46947BCC44405B3715D39D9C86D43D6
MD5 SHA1 SHA512 TLSH

Submit Download

ippap.exe

Path C:\Users\Admin\AppData\Local\Temp\ippap.exe
Size 223KB
SHA256 a9c2bfd809bc338837edf28b50d8b8d39fa80eb4398a14b38c909cc1b9da4240
MD5 647913800bcbdb4fba0e604db6dc9382
SHA1 bc258866c89ab1c6d63a802f0728119a096942f3
SHA512 10ba8dfbdddf37df242719ca8078ec7c269f66825f7a1a28db7559125d66ecb17990952eb9208b1d6fba6fd89dc191da4f52b07773f7ea1f9c92b6df4b51ae82
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3r:unFhSIkAyDgjtS/FZx
TLSH
T12024E042AA018888F38C4B316A17FAE449958D3C59D1F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulquhy.exe

Path C:\Users\Admin\AppData\Local\Temp\ulquhy.exe
Size 402KB
SHA256 39d7bc94fc5051e58dd6d8edf5984136410cefa5b376f2fb5aeb2226140d157b
MD5 9095cd65050cdcaefa8efd722d91eb5a
SHA1 e821d7368b60f2c3a4d761b73bd74f2ad2bf0194
SHA512 0e60c1dba8c3fdf48fcaccf8b6f39e2d6bd4745580320a719d3a8b865e8797ef9aa0eac537cd75a5242bdde8caeee84588fcb07d3fc88b059bfff1d708e7b68e
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvN:yIfBoDWoyFboU6hAJQnrS
TLSH
T1A894BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1060-53-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1060-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1936-55-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/1936-44-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/1936-56-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/1936-57-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/1936-58-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/1936-59-0x00000000002B0000-0x0000000000350000-memory.dmp

Download

memory/2688-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2688-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/2688-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3784-32-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3784-18-0x0000000000400000-0x0000000000467000-memory.dmp

Download