urelas | 7b19586d14a483b7d652876ee1cccf179979f90d85b905bab98274b6da425ec6

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 402KB
Sample260813-mtjdhsxfmc
SHA256 7b19586d14a483b7d652876ee1cccf179979f90d85b905bab98274b6da425ec6
MD5 08c906e640e1955de345c67d43fbaa46
SHA1 6639654c881d4436e5e07fd00382309a8036cdc9
SHA512 525d567f7bf306b309fc646b273a7e33a13ae9375707bbadbee4abcd7ffcbed6a52530eda0f26bc9ea45493523b95af9191c75afddca73ff0c701ce38e30803c
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv15:yIfBoDWoyFboU6hAJQnrI
TLSH
T12994BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
2408	woyvn.exe
2324	ojtiqy.exe
1068	gakeh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
1788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	woyvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojtiqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gakeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe
1068	gakeh.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 2408	5920	2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5920 wrote to memory of 1788	5920	2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 2408 wrote to memory of 2324	2408	woyvn.exe	92
PID 2324 wrote to memory of 1068	2324	ojtiqy.exe	94
PID 2324 wrote to memory of 3364	2324	ojtiqy.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_08c906e640e1955de345c67d43fbaa46_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Users\Admin\AppData\Local\Temp\woyvn.exe
  "C:\Users\Admin\AppData\Local\Temp\woyvn.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\ojtiqy.exe
    "C:\Users\Admin\AppData\Local\Temp\ojtiqy.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\gakeh.exe
      "C:\Users\Admin\AppData\Local\Temp\gakeh.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 7341b9e19e1a9dceeed84542ec856f08de7f276dacf5a8634db6014b5c794f4f
MD5 cbf8c7520c4c76b4b24c4d70346f21e8
SHA1 3005a371ffc508756ac4bd9cea403c47729f0b7d
SHA512 b1c1239ef8df1a15c9d7528fc37c827ccbe14d2b5e4a906db50cb25339f9599ca52036e539f6decb0d6ebe94329ddb88201abc84e65c105b98026e7a51b16c52
TLSH
T13BE0E50252AFD93A0809C02F06A9B68EC0A0A5592FCB3B702320C74D51D588DF0A6251
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 7419196034656681b16d082086c924d323e82ed69a8610640e60a47b9b17241f
MD5 fccbae15afd4edc039ae558609507400
SHA1 d6f755905a57c44c38b8338863306085c323cf32
SHA512 1325b7dbe33c97254399fdd19780a506bc4e042ab8c86059f3bcb9ef9a31f4ec8ceef784b02ec1cba00095678c09665e5c26c631b06be39d01794cf8a3ceeb3b
TLSH
T166D0C711C1D6D75E4448902B0AB5A18DE1754C5C3F473B15A726C98C61D5C1DF5C7351
MD5 SHA1 SHA512 TLSH

Submit Download

gakeh.exe

Path C:\Users\Admin\AppData\Local\Temp\gakeh.exe
Size 223KB
SHA256 283253c2e9f853be563932b27f2a31148ed4fc8c513a44f636ba6d7b5f69d42f
MD5 61c2cd571fc6b5fe6cd28df3848e829a
SHA1 3175f44731d22516e9dee46a15b9d1f804ccfb85
SHA512 0dde853bb84f6e9413f279f85a33ababceeb91107158b6f3844721afc94c9f094d68d1701fb14c5a488b47ab1699990ca78c6af158444e1114f98a526913138d
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3P:unFhSIkAyDgjtS/FZZ
TLSH
T1CD24E042AA018888F38C4B316A17FAE449858D3C59D5F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 749ca9a18339cad96c71f88ba359f81f06b80ebcbffa0897eecdf799fd97778f
MD5 71d511b5a8785a9fcb08c2286bf95538
SHA1 780176d34d303d45e3c4d8e50997437df7c5c1f4
SHA512 03fc3577813b38f400a724df8638cce6306a97bf59db5a1fd0cd38e1c12df65652691b2aa890f1765c99340b1b26e670dea818719cbc3aff92c8796f30dc99ff
TLSH
T1CFF09BD7105DF1553911F62AE3B463B637D31EC81947EC541104F1B05F37D5C4404715
MD5 SHA1 SHA512 TLSH

Submit Download

ojtiqy.exe

Path C:\Users\Admin\AppData\Local\Temp\ojtiqy.exe
Size 402KB
SHA256 63ae90d6c1db3995a1688cdce1b26b1c6a8f962b8fb5da9c3a88be3cf0f3534a
MD5 05bdeef2ea74cafd727d8c7cbf8f9936
SHA1 24c87c28fbfefe95c21608d8c349384b993d10c5
SHA512 b78e8a87f38a2ce16b1eb458ae352916d0ac011a3573685063a88ef5bf69c124991b87a2f5bf68297747118a3173856f1f35b43511d0d42fface5d606e53fd65
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv1h:yIfBoDWoyFboU6hAJQnra
TLSH
T1D394BD253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

woyvn.exe

Path C:\Users\Admin\AppData\Local\Temp\woyvn.exe
Size 402KB
SHA256 fdda68eea024c7c4e4317ef01d2e53b16786d2f779525865f84fdbee850739ec
MD5 c940c19f9034813f4fa11fdf2391080d
SHA1 c6690761274f322c49ff93e57bf4bd73038abe8a
SHA512 e3daaf9c1a200fb84a4ea001a08b7d802a1a0af49fed0b33d3aef496eb6576b9e18ff8ea43d4368e5c29ddf24d75f945ed75bfa73aaf24a264eaf9695ce00e13
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv14:yIfBoDWoyFboU6hAJQnrn
TLSH
T13794BD253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-55-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/1068-56-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/1068-59-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/1068-58-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/1068-57-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/1068-44-0x0000000000540000-0x00000000005E0000-memory.dmp

Download

memory/2324-53-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2324-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2324-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2408-14-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2408-32-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5920-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5920-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5920-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download