urelas | 26151c50d8fa09430fd61baffe0d009437adb9251b7589bbda6056e0e407c551

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 307KB
Sample260808-lxcvgach23
SHA256 26151c50d8fa09430fd61baffe0d009437adb9251b7589bbda6056e0e407c551
MD5 86ee20ec85eae04e935076aa665eb4b1
SHA1 92ad72b88f526786d9c1425f223b286c6d192070
SHA512 03aa606c35b56315154532961fff213610c065feee0753447c0385109909a46e6c466685c01a790a5afd3ace5fb1eb35a4ba30190ba863307f216e3c64f7c2bb
SSDEEP 3072:BQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopBE44:BQi+reSUbnbA8VKQq8hpW6p75PpBE44
TLSH
T1B3649C113980C4B2E76A07310406FAE44A6AAC3E1B95E58FF7787DB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4492	zucol.exe
3248	azazko.exe
4588	ovgui.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5520	cmd.exe
1792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ovgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zucol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azazko.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe
4588	ovgui.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4492	5104	2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5104 wrote to memory of 5520	5104	2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4492 wrote to memory of 3248	4492	zucol.exe	92
PID 3248 wrote to memory of 4588	3248	azazko.exe	94
PID 3248 wrote to memory of 1792	3248	azazko.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_86ee20ec85eae04e935076aa665eb4b1_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\zucol.exe
  "C:\Users\Admin\AppData\Local\Temp\zucol.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\azazko.exe
    "C:\Users\Admin\AppData\Local\Temp\azazko.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\ovgui.exe
      "C:\Users\Admin\AppData\Local\Temp\ovgui.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 8d90dbcb03d828e0737521f883f25cbb348d262a216ff6737e51437570feb713
MD5 d149b494b086013e82949e77e571d942
SHA1 cc46af1e8fa95aec7f5cb5b148d49c2c8a813abd
SHA512 947d97a8156b4ad5f8447929db358cb89adf3cb23c54fa99548d6511b5a4ad713a7f15be776404363fcfa3faccec555f33df5e1509d05fa51bafeaf629a69618
TLSH
T184E09B0505DEED7B0408D02B85A7649E815499D47F463BB17621C95C51D5419F6A3241
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 f68c6cabf08e21b382e97ab02eb6a5f62bdb454a60ae8f1e1013fbb6178f3a73
MD5 d3a8f01ca5860b6acf07e54d3a329eb7
SHA1 f88e5de71257c09470eeb2346a92c7cdac4a3cc1
SHA512 b2d995057647a5e4acec21fa605c78278daa5776e4166c2f355a333ed54ed4ffecca3469f45e77b09ebaa5ec1b8128d02c4ca92ddcdc6c2b0b9d8f09f9e5cfc1
TLSH
T168D0C71145D6D75E0458D42F06B5718DC0755C5C3F473B159721C54C21C141EF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3a956931b1b23e861d78a81525b33f90a92f04d9d1a0830de81e81659f46db55
MD5 e42e4c429f0576c7020bb81a23fab52f
SHA1 11b2ac5d08ddc51aca327d8adb4854fbc4a1e169
SHA512 9e9fcbd3a15c965e022e4b67b08bb8b5657fd612f77c55decc0e6f118b42d116e19b51469e17dc7d2d747b3b4e3efe1dc1666f78df94777171bd67d01c934015
TLSH
T101F04CED2075A1597612F623D28417D01B930D892A8BCC4C4204B570497596C84446A6
MD5 SHA1 SHA512 TLSH

Submit Download

ovgui.exe

Path C:\Users\Admin\AppData\Local\Temp\ovgui.exe
Size 111KB
SHA256 b77f6f48c20428a6d33f9774c8534f47dcdd20f3a3bf2ac9c4b5b4917eeafc4c
MD5 ee270c05edb6fd1ffb8c68f566135b1f
SHA1 c6efa8f4a0dc6b8a4f534abba3dec916a65828fe
SHA512 37dc01f51ab7f687c5a1ff29b34d34caeb13a860c6b629c0cf656fc05998c759771cce675931a8d8048e28a1fde772ee1bd190bad45266a3f4ff75b7fb3beeb7
SSDEEP 1536:jH21ZVCMSo4l3nhZgnDuJsJV1/1WpkUCVBZXwvZ4Xw93DgN0:jWrW53nhZSuJ21/fUCHhwdDm0
TLSH
T1F7B3D043A60084A8F71D0B311942F9E054A59E3CA9E9F50FF13C7C7AB9B21975AB319F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zucol.exe

Path C:\Users\Admin\AppData\Local\Temp\zucol.exe
Size 307KB
SHA256 32c247b4693ccdb5c6f8d10a7a9a8b529f80458fdb704dfadd4d1bfc7dc6ef52
MD5 058c14d10af1785e82c4c9c6edff141f
SHA1 89877730dc09e1d3fca76989e9a9e1d236992cea
SHA512 4ed240528130edbfae9826bc213ce8c0e8731fdbf0675c2910f0abfd45a4413c400b8040fecc2c32de3afe04d24f085ca675035448aa638a2d72dc4c3cf773c0
SSDEEP 3072:BQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopBE4Q:BQi+reSUbnbA8VKQq8hpW6p75PpBE4Q
TLSH
T125649C113980C4B2E76A07310406FAE44A6AAC3E1B95E58FF7787DB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3248-25-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3248-48-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3248-26-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4492-20-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4492-24-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4588-37-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-39-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-50-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-51-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-52-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-53-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-54-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/4588-55-0x0000000000890000-0x0000000000918000-memory.dmp

Download

memory/5104-21-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5104-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5104-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download