urelas | fb392d5fa3bf36a5eabb0495fb8e58ac5b5d65ce05e34c8d9579f68f4b6af00e

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 3.9MB
Sample260809-hjl97ssera
SHA256 fb392d5fa3bf36a5eabb0495fb8e58ac5b5d65ce05e34c8d9579f68f4b6af00e
MD5 6af4445b558893a02b9aa1e2c99f0620
SHA1 bef7cac5c5ebcfc63e11371e903e7c746341fe07
SHA512 c9724950514b7ac61274f7b93a6514023207b24a2dfcf15ad4b442131a2244b3f9fd21e761db2274fb853bbcdd943e49b4b2960979e44cc6c1c1b949661c31a1
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFg:NMvrRb/G8+Hg
TLSH
T1FA168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4756	ursuj.exe
6096	yxfio.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4192	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1676	6096	WerFault.exe	93
5292	6096	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ursuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yxfio.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 4756	3860	2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 3860 wrote to memory of 4192	3860	2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe	90
PID 4756 wrote to memory of 6096	4756	ursuj.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6af4445b558893a02b9aa1e2c99f0620_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\ursuj.exe
  "C:\Users\Admin\AppData\Local\Temp\ursuj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Users\Admin\AppData\Local\Temp\yxfio.exe
    "C:\Users\Admin\AppData\Local\Temp\yxfio.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 260
      4⤵
      Program crash
      PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 276
      4⤵
      Program crash
      PID:5292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6096 -ip 6096
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6096 -ip 6096
1⤵
PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 68149a35eeda4a99c6f4abd3b840a09f5189e3e4ec03c0fcefb467e2b906290a
MD5 b05a2f22a82d0a54eecf406dd4835585
SHA1 f223c534bd29618974698e5fa0eeb533970a1e20
SHA512 094d0eba840ec8400262d7229702a87590485d37379070ecbc6193ddba694b860937936fe5f20857e6b2e30855f1b900392c1303c844f4a602011487153e704a
TLSH
T10DE0D84114EEDA69090CF03F0569694EC0E564ACAF412B209735C64E22DA89E75D2B22
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 30452a6660fd1d51424d181cbadf40ae8f65087014eadc8c42257d13053c1e01
MD5 aa0f7de8ff2ded40130d7712d504e6a7
SHA1 ec6074d92fc222a22d955c95c00bc6c590891671
SHA512 dd9d607a6532dcb97401ab360c92d2ce6714dfa519c95c1ef73a817327f7b79ac98233e47411fb7fad3daf7267072ac9bad6fbaf708fc2b537b659932af428b9
TLSH
T138F02BD92051B000F303F202D3D09F8113C30C491BC39EC84009B130C9FAD4CC484303
MD5 SHA1 SHA512 TLSH

Submit Download

ursuj.exe

Path C:\Users\Admin\AppData\Local\Temp\ursuj.exe
Size 3.9MB
SHA256 e14dc05302aa363744b38365dfab144a262c8be4e70adeb39e9c5f60f209a623
MD5 50ddae87e46487f746faca8d9891e7c7
SHA1 5763d8e0489cbfdff78b6c373ef2b9a9a5fbcaed
SHA512 4767392b790ba355c15c36aa8e4c5eeb7e99992c296d4115201fef2a5a24631d27b8da38a936d5afac8e3d427d139d373411ba66954485b8b8824c7991d4956a
SSDEEP 98304:N/NC5jnLrHp/qKm2/Sb/gqAZj+UzKb3HtFu:NMvrRb/G8+Hu
TLSH
T1EA168B13EBC14AE9F38D05365B548140D72AEE21AA4F1351346C326DDFA73878F66A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yxfio.exe

Path C:\Users\Admin\AppData\Local\Temp\yxfio.exe
Size 231KB
SHA256 5c6d3f1f66d2bc4d0a4399273d8ee5a2335dd76d7017e0055ae94bb99141233e
MD5 15499bb22eb30ac2914f10f5dd1cb507
SHA1 b089689fe20eb629f2b232f40bbc3e0f4d0e4005
SHA512 3c1fc533ff56b9885b1028b76975cde4b067dbb520fe7143d07dccc6210f8253c1b329aca2d006080579abb47faea9b96d0aa5abe626eaa3799e0a73b911b00e
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiZ:z6r5cTfS/ZPHUWoQISzqJBpiZ
TLSH
T1B334D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3860-1-0x00000000009BB000-0x00000000009BC000-memory.dmp

Download

memory/3860-0-0x0000000000990000-0x0000000000D82000-memory.dmp

Download

memory/3860-21-0x0000000000990000-0x0000000000D82000-memory.dmp

Download

memory/4756-13-0x00000000000C0000-0x00000000004B2000-memory.dmp

Download

memory/4756-24-0x00000000000C0000-0x00000000004B2000-memory.dmp

Download

memory/4756-14-0x00000000000EB000-0x00000000000EC000-memory.dmp

Download

memory/4756-35-0x00000000000C0000-0x00000000004B2000-memory.dmp

Download

memory/6096-33-0x0000000000C40000-0x0000000000CF3000-memory.dmp

Download

memory/6096-36-0x0000000000C40000-0x0000000000CF3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads