urelas | e865174584470647665f2ef9e065a4ca0b3108e64f7ab4ebbe78865414c25b2a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 355KB
Sample260807-eyaceadh72
SHA256 e865174584470647665f2ef9e065a4ca0b3108e64f7ab4ebbe78865414c25b2a
MD5 cd2c693443f4da7ad1d282a755737735
SHA1 24f34a5ab0f18148c4e76bc9b229d181ca315bcb
SHA512 c2d72109e1f5a7bd529285c20822a6d15950fd421b5db2cb50aae40e9421b467b063a221cf4b98dc13e928c33243caa7eb1344fae85c592159050836b026f1c9
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzi:wd7rpL43btmQ58Z27zw3eZzi
TLSH
T193749D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	pumec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	apqaix.exe

Executes dropped EXE 2 IoCs

pid	Process
2104	pumec.exe
2796	apqaix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe
4712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apqaix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pumec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2104	2852	2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 2852 wrote to memory of 1512	2852	2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 2104 wrote to memory of 2796	2104	pumec.exe	89
PID 2796 wrote to memory of 4712	2796	apqaix.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_cd2c693443f4da7ad1d282a755737735_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\pumec.exe
  "C:\Users\Admin\AppData\Local\Temp\pumec.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\apqaix.exe
    "C:\Users\Admin\AppData\Local\Temp\apqaix.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 ac7ca849dbfc57da851e0759abbf2c2c31b11cea9148d0e6d537f7416aa92ccf
MD5 f84f2f3c1f29848ab99ec95f6cd52f6e
SHA1 86dea1943e75bd26ab33ef7ee6c7a534d1eed70e
SHA512 93cd2750d1697d859a17cef076287c7755391fe5cd0649e7503520860f39c5e702ee0b74b4c0ac45854c8554fe0ab93af14d0eb9bc9e01c57f1efb8e2b0ff7ed
TLSH
T189E0D80101BEDD2E140DD42F45E9A88EC950B66C7F8637657731C29D11D246EB6D2692
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 56e85d02a36586b67040ffc9e7cbdcfc3ba513b4ee7f666c7fca9301b2cf928c
MD5 5694fcedab5fab74d9ab23216ab7fff9
SHA1 3c58a7db086ca89019184a4b28b5bd6d15a5a167
SHA512 351d211cb0d6529ec525d6a8129b42549184d3a974458a9ecac3f6733db6f7bdc682a895959c560e762fe7682383dbf506408efcf1aca9239e2e27c0bbbc238b
TLSH
T1ACD0C71141D6D79E0458902B06B561CDC0B58C5C3F873F15972AC54C21D141DF5C7351
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1938b65f87fe898831006e0dd1492899ef8c38c5d1e2f07464539096690ad422
MD5 05695d08a0cc7b5a6a2f877c956a3524
SHA1 39e4b5d77ef0f31d2e5e9364763925375171c244
SHA512 01e869edb56b070a290373d1d344dcb20dca9751985fee03abfc28eb8537005e5d151230bbdcbea7f8dca9b9bf71cffd4afaf9ef3fb9c97e24aaf92d160388f9
TLSH
T119F09BD22055F1913716E612D3851B54B7F36DC559C7DE904106B3704D75E7C4444395
MD5 SHA1 SHA512 TLSH

Submit Download

pumec.exe

Path C:\Users\Admin\AppData\Local\Temp\pumec.exe
Size 356KB
SHA256 e47b9f05adbb4cd4f490f62acf86704ef7f3b63fde566bcd52227faa3afb8aeb
MD5 c2e2138e5ee59a0c8d51f9852576ae0c
SHA1 4fed9e148d41620f48e15528ab78759ca3215386
SHA512 cf2ec893ffb15ac7d857150ad6b1141bc8263b118c621080e9cb26c97169e818af68390a5b590e6e55fb28fd175561d813ec0821d988d9254a79e8b5d38f9f77
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzG:wd7rpL43btmQ58Z27zw3eZzG
TLSH
T1AC749D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-15-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2104-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2796-27-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2796-28-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2796-33-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2852-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2852-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/2852-17-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads