urelas | ca028b5801c9f308993b8c3ee317c90216796b5ba28aa555c8e5e8aaec762ccc

Analysis

max time kernel
149s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 302KB
Sample260805-f7d8dsar3w
SHA256 ca028b5801c9f308993b8c3ee317c90216796b5ba28aa555c8e5e8aaec762ccc
MD5 c8bce5aaa35ad18c435209b3e61ed5b7
SHA1 a047ad46dd605a50fbdeb6e852b8788c0af5c0f7
SHA512 cd019310adfe3ebc64135d44ac5eec9fc0641a03acec81403dc1454de379b602e33fc74f7492d24a5b7ae883a3c98e91e6ddb39aaf76a863d35d5e32d5ed1b93
SSDEEP 3072:dQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopB2HA9:dQi+reSUbnbA8VKQq8hpW6p75PpBF
TLSH
T14D649C103980C4B2F76A07310446FAE44A69AC3E1B95E58FF7787EB968311D3567B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4080	fahae.exe
1420	wowyqi.exe
4748	jimoi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3624	cmd.exe
2392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fahae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wowyqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jimoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe
4748	jimoi.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4080	1060	2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1060 wrote to memory of 3624	1060	2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4080 wrote to memory of 1420	4080	fahae.exe	92
PID 1420 wrote to memory of 4748	1420	wowyqi.exe	93
PID 1420 wrote to memory of 2392	1420	wowyqi.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_c8bce5aaa35ad18c435209b3e61ed5b7_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\fahae.exe
  "C:\Users\Admin\AppData\Local\Temp\fahae.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Users\Admin\AppData\Local\Temp\wowyqi.exe
    "C:\Users\Admin\AppData\Local\Temp\wowyqi.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\jimoi.exe
      "C:\Users\Admin\AppData\Local\Temp\jimoi.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 f994f3889ae49855d8f7335b9cab45429589fc211b04e6af6f9e0a32ab25b796
MD5 439247896774e74b69cbd2d08715164a
SHA1 8b473cf2a5d96716c3a36e13054fb12fdce13b42
SHA512 c4ffcea9923d16342c4f45630c749c32887dfbe857b176a368885b5bc2ea4b9a179e85b26f162bb5618287d1fa4f75430a80c615214e9c1f293015c5971bf212
TLSH
T1DFE0D86111AAE966090DC02F06E3A58E8154A5987E8A3F70BB20C65D23D245FF9D3B16
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 fd5d612419e919a097e35dfbdcb98e5a4089de83ec06b4fc34c64a830728a61a
MD5 ca19bc8ba98b0b0cf93d3180b00824e6
SHA1 bc03c15ea4e4ac1cbe4eb4dadee491660895574f
SHA512 5b04195a2660cd45394c6866d04fac8f3ca896fc30d85af5aa55cd8486192779dc9c723bc19940aaec98fbe46e3be7ac0db38ce11c1839466dbc664c5e082d6b
TLSH
T1B2D0C71141D6D75F0448942B06B5A2CDC0B54C5C7F577F159721C48C61C541DFAC7341
MD5 SHA1 SHA512 TLSH

Submit Download

fahae.exe

Path C:\Users\Admin\AppData\Local\Temp\fahae.exe
Size 302KB
SHA256 1e55829c341b385c5f8f1b4ef994b41826dc5e91620e67ee73d6ffddc275c9e1
MD5 d1ffd2959b004e9405d29c4f66b52fdc
SHA1 38119879f0eb5fb14bf79423ce5495cf5f3f089c
SHA512 7e02b541ab8cca7c38c6673cc2071537c733cb7f8c6c154d5ffbe4b520ed422c97ab67b11a5ac63ad4653fb5c63c3b518e10c8bc70051611fd4097e3f43da674
SSDEEP 3072:dQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopB2HA6:dQi+reSUbnbA8VKQq8hpW6p75PpBC
TLSH
T1D4649C103980C4B2F76A07310446FAE44A69AC3E1B95E58FF7787EB968311D3567B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 7cb29bde26bf4268852a8e4e855c44e76a53eb45939f498aa6eec6741ef9ecdc
MD5 966380a28f1f69ef75f77e20a1a27669
SHA1 56adcb5fe44affb85445f032066f0a5b74c71c9c
SHA512 944d961830d619a529a6a6091008f1e2fdd579150bd61d5d028d766dceb034c4b553a122907d748c9555637b4883200c0d020793474d0496d091497677042409
TLSH
T133F04CD511A1B1873615E126C2855B9537934D9969C75D804204F5714935D7C4684256
MD5 SHA1 SHA512 TLSH

Submit Download

jimoi.exe

Path C:\Users\Admin\AppData\Local\Temp\jimoi.exe
Size 111KB
SHA256 9da17c9833bacbf6411c5d80b3b1bb972327b67d0d945f37f3240656d8e08f60
MD5 9c6ea11003e5a41a7bb79952a2d93c08
SHA1 aa5f2d0c5c4b7298c4549e6cacbb4d154f61c225
SHA512 77eedb5a2b6b19cfa5eea31f4a578c4d5820416a96d58a296be09c0f3aded2ebc93f5398a7d3c1f23ff0b92660f56ebeece0ff6cf592f6754c52a257d2e93485
SSDEEP 1536:jH21ZVCMSo4l3nhZgnDuJsJV1/1WpkUCVBZXwvZ4Xw93DgNE:jWrW53nhZSuJ21/fUCHhwdDmE
TLSH
T143B3D043A60084A8F71C0B311942F9E054A59E3C69E9F50FF13C7C7AB9B22975AB319F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1060-21-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1060-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/1420-45-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1420-26-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1420-25-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4080-24-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4080-14-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4748-37-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-46-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-50-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-51-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-52-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-53-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-54-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download

memory/4748-55-0x0000000000D70000-0x0000000000DF8000-memory.dmp

Download