urelas | b7a580ea0effa9bd877f572c5187d0d4a798eabf0d4e1c5d5763e97761df1a71

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 595KB
Sample260815-mpgn5athnc
SHA256 b7a580ea0effa9bd877f572c5187d0d4a798eabf0d4e1c5d5763e97761df1a71
MD5 c72fc9662f43f28a81dcbfd6e9b35f44
SHA1 7cf767ed24c4be0dee13231199c245853bbabb5d
SHA512 18cdf7463b8e4548de274d438c822bbda752ac74ce574036afe269c6e4e69257a1731a226990c65c5f92116b82696beba6dabd6f9b36a5d4c142c151212ca2fb
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdF6:8MpASIcWYx2U6hAJQnZ
TLSH
T15AD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
1376	wyjuq.exe
2884	gyhylo.exe
1536	ifnoy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5060	cmd.exe
4472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyjuq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gyhylo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifnoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe
1536	ifnoy.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1376	4500	2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4500 wrote to memory of 5060	4500	2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 1376 wrote to memory of 2884	1376	wyjuq.exe	92
PID 2884 wrote to memory of 1536	2884	gyhylo.exe	94
PID 2884 wrote to memory of 4472	2884	gyhylo.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c72fc9662f43f28a81dcbfd6e9b35f44_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\wyjuq.exe
  "C:\Users\Admin\AppData\Local\Temp\wyjuq.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\gyhylo.exe
    "C:\Users\Admin\AppData\Local\Temp\gyhylo.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\ifnoy.exe
      "C:\Users\Admin\AppData\Local\Temp\ifnoy.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 db4298147fa47ee4e831c34be0a441e7f5a3691e7e39bfcd0c0ab32a4aa5e3ec
MD5 d70f1ca88868c4930bbf537f56ebfb4b
SHA1 dbd0683e34c1d236005cdc6a8d200b15c1033eb7
SHA512 5a84acfe90281a8df2192e6eee38ccd885dec3bb04fc3d8f1458a350a973b4c77e969a950b0dbc2ae95aa9885117be845ae31134b4b9589e43477faf1cab5cf1
TLSH
T1F4D0C71141D7F75E0448906F07B5618DC0759C5C3F473B159721CC8C21C181DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 d9aa9c1321afadff6ddf041d2eb5dbcc6eed289317ce50fcc1485f7e04aaddd4
MD5 cd5dcb9dab14a003309ac48450a72f88
SHA1 24c6f87a8d43f893d880bb02e5fa5ffac72afe50
SHA512 4467bce088eaca59a0fe3e22874eecf60271a0902882d9c71269cd7d79aaf28b5e9014a1af4a6f8fd586ad9a233171fc34bcc0f706f2e720e97d175181795716
TLSH
T136E02B9100EFC92B061DD01F02AEB5CD80A459553EC727713B20C60C51E544EB5A3253
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 c8794aee4697bc4b37f3472b4d389b8d90ab1c555dae6cb68914f63156a31709
MD5 a09d6f3d8662bf4e3a07f75e7de7bd77
SHA1 5039d223e968365b9bd46311c9a2cd5e7a595931
SHA512 077b3a6f45d0e322f680896628d41762ceea9947052b131a97b7eb714ca610fd72f045ff573ff5630375268ca964d882bfac6bb8c18d5f8fc437d9f395b14543
TLSH
T1C7F09BD93091F4473615E327D3A45F5127831D445E43DC584145F23659F5CDCC554355
MD5 SHA1 SHA512 TLSH

Submit Download

gyhylo.exe

Path C:\Users\Admin\AppData\Local\Temp\gyhylo.exe
Size 595KB
SHA256 0e8d68d6613a3a3338a05f81a97f3d51116e392605c868d4c09196a9b495cfb3
MD5 9cc67e9b08446398b1514e3d4ba079bc
SHA1 249633f416039a5e8c7d8980424f645fe1e49e13
SHA512 2beb30a14325e836d04ea464ebc5ec07bb4e247a1dce401ac62afde77e5a8dfc8fbf9141234a073f7105881583ba41147dfa3788285dbb54a3ce1984680c77e3
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFl:8MpASIcWYx2U6hAJQnA
TLSH
T192D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifnoy.exe

Path C:\Users\Admin\AppData\Local\Temp\ifnoy.exe
Size 223KB
SHA256 96a19ba7cf529ecb690596bae6b7924ccbb6f33a39f0217898f0de81f7d81279
MD5 8d2101b17a0ce37765385d62f0e83d4f
SHA1 396fbe1f6a64cbff9973eed7e8e8eb39e075d82a
SHA512 d8b67ae5e4783ece3a12c89367d7935a3bc2547f5dd134cb5dd5888f9c30f978221fcbd2ebf9eb6b6abba29703f6933e13f591d94f6b8ba8d26038f611eb19fe
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p32:unFhSIkAyDgjtS/FZo
TLSH
T16F24E041AA018888F38C4B316A17FAE449858D3C59E5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyjuq.exe

Path C:\Users\Admin\AppData\Local\Temp\wyjuq.exe
Size 595KB
SHA256 6740abb4485e4d95ed8fef8e1678236eb6a239f658f265d8da55b5dc04c66b6b
MD5 3270392ba4f6f409981a00e9ba9356e4
SHA1 af18b6a7130105c7dd4f1f371fa8e88384302e0d
SHA512 aae23afbfbb56d3fb076cb1dba617ae9cb89e2b77e73898df53ce517d8584e3295a9ad7f36f5572d00bd0da5b00b9577331025f11a3aa36c86ae5eccda141069
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFm:8MpASIcWYx2U6hAJQnv
TLSH
T1F7D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1376-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1536-55-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/1536-43-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/1536-56-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/1536-57-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/1536-58-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/1536-59-0x0000000000F50000-0x0000000000FF0000-memory.dmp

Download

memory/2884-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2884-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2884-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4500-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4500-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4500-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download