urelas | efdc5532d12d59c76aa3deabc0e13379b86d9c227c876948546f013c84af99b1

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample260804-ttnfssvbqe
SHA256 efdc5532d12d59c76aa3deabc0e13379b86d9c227c876948546f013c84af99b1
MD5 2b6c063fe6047202038163dd561e5971
SHA1 ccc3f5dd2a912a607092016e470ca6ee5db53f7a
SHA512 4133544c857ac1fb0465ab6792582fc6f4a780659ef5c29a8eaeb66ee5401fc6765420ad44dbfaaf56ce38f924fb39ac6d93c604b8bcb274dfe104329120c3d5
SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUeb:L7dLBeU9g16AVDKUTbQIzFLwrV
TLSH
T15D850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c57f-36.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
1324	vyebs.exe
4252	qolifu.exe
2272	fyfuc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	cmd.exe
1336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vyebs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolifu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fyfuc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe
2272	fyfuc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 1324	3988	2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe	89
PID 3988 wrote to memory of 1040	3988	2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe	90
PID 1324 wrote to memory of 4252	1324	vyebs.exe	92
PID 4252 wrote to memory of 2272	4252	qolifu.exe	94
PID 4252 wrote to memory of 1336	4252	qolifu.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2b6c063fe6047202038163dd561e5971_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\vyebs.exe
  "C:\Users\Admin\AppData\Local\Temp\vyebs.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\qolifu.exe
    "C:\Users\Admin\AppData\Local\Temp\qolifu.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\fyfuc.exe
      "C:\Users\Admin\AppData\Local\Temp\fyfuc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 416B
SHA256 d7be764595457baa51e31d8c65420d5bf04b172f1c180ce8fe49b8c9010ad197
MD5 10a6c6c56e93b4d61add9062e1ce6b73
SHA1 6c71488ce08ce281dc7355503ab943ddf0f0f91a
SHA512 b0dc305ab7b5f2538a629b0ed94f62324b2df83e3afcbc54f1da4d66cb8d0f582b0b278f822c7549d0d9b289d87835a968b694a5a9155e69e209b2cd07d5aae9
TLSH
T18CE02B1100DBCD16040DC01B4BE0758E81E97ADDBE523B317730C95D22F640FB4A7253
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 7716dd53f5b33e3eb8fbdc4378eb842ace4dec2b65861fdf3aecbe33f8bca0ae
MD5 a6e26e4078d880d426feaac983d74e77
SHA1 12f78e2a53d46b0d8be547ee0704c5b6eab8a7c9
SHA512 9588b5b90d3e8f9ec4c2ab32d2272291a37deaac9d1fd32eab14aba1afeec69fe3c64d322cafe90aa08eba15cf9e9e190e7fadc3b8e2f3409c83ba2a81219643
TLSH
T10ED0C71141D6E75F0848902B06B5A18DC0755D9C7FCB7B119721C44D61C181DF9D7341
MD5 SHA1 SHA512 TLSH

Submit Download

fyfuc.exe

Path C:\Users\Admin\AppData\Local\Temp\fyfuc.exe
Size 136KB
SHA256 5edf56b396dec9b3fe4fc5a962ef1a3e718fc9061bef8b76899ed1d91790d72d
MD5 9c1c9ade59f3e55b506e7598ce93ab2e
SHA1 9ba3d46e0749a48b38118ef475e5784a9742890e
SHA512 df4223f96271ca8177f9f194c0a7b3f258bff11962fb8a63913dd2185826160da89610f45822ac88ea9b5e67e45a1d2fd1169ab0ae1e770636463a181e7719c1
SSDEEP 1536:jOgVPwzJWY1urHjjwJDxg0trb8jJzPnGC/s+BXLE+ptlf26WLpflZY:jRwkYQPwtxZMhPGClgWjSvZY
TLSH
T17BD3AE5296008864F35C4F305916F9E50A9A9D3C68E4F94FF13CBE3A68721D7AAB344F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 fb35d86e4bc1817fcd5fcb591383c35a1f2f98cbf9c1a00b27ff926648f6ee7a
MD5 50c6c0dc08f18a36b31c807cb3f6e335
SHA1 dd190cae389621d5f2ab9e895abae50858cc9154
SHA512 93d75c31e14c88d9998a50c36ee80c4d529caafa24a3ca468756d14bfdc219c8fcc01227479f7f41f6b13fd439fd0d938d337b98c50b0e11ddd711279db5d87e
TLSH
T1DCF04CD22055A8553A12E716C294579657E31DC92E87AE804149B2708D36C5C4814296
MD5 SHA1 SHA512 TLSH

Submit Download

vyebs.exe

Path C:\Users\Admin\AppData\Local\Temp\vyebs.exe
Size 1.7MB
SHA256 b5c222ade465d9b90293a20bda3129ce651393f83eb2cb840389fc91bc54b274
MD5 9d0382bb50cb262899355d3d9f02588b
SHA1 68d393e7f8d696a9c0dd7e333ced126f6d849b7e
SHA512 79ab4d0bfbc50d3f13c3d336e5fdbe903f8547c47fe9d4d4de8db5325962da9721c474825ce409ce90b16626125ca1403234aae63dc7349881172ceb2f6fc545
SSDEEP 12288:L7dL4AZ0U9gY2F/eyL1Jer5+ngA1YaL8i0DMUNLtG4+tbQIzKYZLwTmer5+nIUet:L7dLBeU9g16AVDKUTbQIzFLwrr
TLSH
T169850753EB814AE8E75D09365B544150D62EFE21AA4F2350786C720CCFA738B8F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-26-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/1324-12-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/1324-21-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/1324-27-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/2272-43-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-55-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-60-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-59-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-58-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-57-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-41-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-45-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-56-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/2272-44-0x0000000000890000-0x000000000091C000-memory.dmp

Download

memory/3988-0-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/3988-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3988-22-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-52-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-53-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-28-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-30-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-29-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4252-25-0x0000000000400000-0x00000000005B9000-memory.dmp

Download