urelas | 3b0b9dd20be57c3700c9218762b5ae726add1fa1c58c0bad1ebe9c335a0bcc7a

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 409KB
Sample260818-tyysbsxtb1
SHA256 3b0b9dd20be57c3700c9218762b5ae726add1fa1c58c0bad1ebe9c335a0bcc7a
MD5 f04ec2e10a25cfcfaad12211b263fd9c
SHA1 ca3c772a35087874d47f482f7076215cc8b236e2
SHA512 8b38bdc1e3dc5d0c2129b7502948c32296011426d36eb169073c3dd52d542f3fb74f73ca30618366070cae524686b8469886b41ee44af8a8e166dde5ce58a197
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7oho:YIfBoDWoyFbkU6hAJQnae
TLSH
T1DA94BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
5464	puazq.exe
5928	azyfoh.exe
992	xopiu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
968	cmd.exe
5672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	azyfoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xopiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	puazq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe
992	xopiu.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 5464	3348	2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 3348 wrote to memory of 5672	3348	2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 5464 wrote to memory of 5928	5464	puazq.exe	92
PID 5928 wrote to memory of 992	5928	azyfoh.exe	94
PID 5928 wrote to memory of 968	5928	azyfoh.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f04ec2e10a25cfcfaad12211b263fd9c_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\puazq.exe
  "C:\Users\Admin\AppData\Local\Temp\puazq.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Users\Admin\AppData\Local\Temp\azyfoh.exe
    "C:\Users\Admin\AppData\Local\Temp\azyfoh.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\xopiu.exe
      "C:\Users\Admin\AppData\Local\Temp\xopiu.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 141255dffe002d35af4c6b11b9d1a8d4dbae8f5d139a9dec4756bf0360d3febc
MD5 963ef2365bc0fcb190bcd6c7ff7432e0
SHA1 a82813bf007c5ef21cc1f4b6f62f763b3c32986e
SHA512 d3bd8434dff722b264f1fa191cdb56e41da1650ddc02aa289679fe8f1bdae43a4e7c1a02a9fc801e41ef5feb8961a289537ba2ef9fcac7f6838ed5044515ae89
TLSH
T124D09211819BDA6B0859902B4AB5628DC0698CAC3FCA2B15A621884832C281EB6D7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 37fd521ffa6119e10db975b3b9adf62409c5cec4c0ac9675c42dd44e64f8dc5b
MD5 48ad376c7f626db924cd4e875581d102
SHA1 fcd79b0a1f0212998decceaa5abb6a3feff9725f
SHA512 2ecc588290883523020cc62c92587700b9f999d6ded3dbcc43b85a97da406c46a09e21a4a6f25b58a6d01ca119cde5a8d5ba36e0c2d6d633b57e69e7fbb292f1
TLSH
T1A9E02B0040BFCE2B080CD00F42AEEB8F929865593E872B767B20835D61D594EB8B3252
MD5 SHA1 SHA512 TLSH

Submit Download

azyfoh.exe

Path C:\Users\Admin\AppData\Local\Temp\azyfoh.exe
Size 409KB
SHA256 970f2ec5bdea5628858ed32a17848be32489d705b74026855f0f83c1d50805cd
MD5 4608fd1eda1e4014f03cbb14a1c5156a
SHA1 27e0040eb4e50858fbe01107554519b320476b77
SHA512 5004e937c07a3dc105c3586469ff91da036d2fcc7669059f1b464212935d214fe63324664c1866521e6b5e47726322e5c30a632fdd312718ed938a58c5481889
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohj:YIfBoDWoyFbkU6hAJQnal
TLSH
T1D494BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e551b8c6aed88ca9d3c0a072eb25a73a43f1aeb96f848206cd87c521b5032e69
MD5 490f11c4838be9d073a5b1e275989674
SHA1 d9568b650a8188bad03298f0c03beb9e81636a7b
SHA512 0cc163b309b8d8ca3c687da74e9b375e457121c7246304b9297b5dd7f915853b52eeb767a0bb33fc8a49961ff3e62d86ccaed019e631c800df99f81703619417
TLSH
T1A1F04CD56051B0453515E623D6A45BD527A35D881D8BAE45428572648934C9C84483D5
MD5 SHA1 SHA512 TLSH

Submit Download

puazq.exe

Path C:\Users\Admin\AppData\Local\Temp\puazq.exe
Size 409KB
SHA256 41722ac3630506dfb07a0913fe559080fb8d97e280fa1b5323f0ce76ed43554a
MD5 948ae9b197d18d42adc86003ef0a3889
SHA1 631be27021d2c4d81019f8fb719d7f21a4d70923
SHA512 26a013a72e18dc5d54eaccf3bb76fc7aec10d18edda7be4f1af94593ef000757e2b12ce5d6f72fc41d8688aa41127e42839dffb651a23f46bd426654c805c264
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohS:YIfBoDWoyFbkU6hAJQnao
TLSH
T19694BE253540C436F3290B354855EAB10AA9BC3A14D9E48FF7787E7A6D321938B7B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xopiu.exe

Path C:\Users\Admin\AppData\Local\Temp\xopiu.exe
Size 223KB
SHA256 28bc2650624e283729c99b8f45363a8ded28b08e7339cd19ad029d5f61c424cb
MD5 73bd80220ce44c7b3ed219bf566eed3d
SHA1 ae0261ec949d2faccd354941c1435dd45a063275
SHA512 e53444dc56bda84e0a7f38600186f6c1b933535b64924a21698ab1ae5cc0fab17716c1210a16795de67c02ef2d668ec082ce3edb42b22662065d31fec5a2445d
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3P:unFhSIkAyDgjtS/FZR
TLSH
T17A24E042AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-55-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/992-44-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/992-59-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/992-58-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/992-57-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/992-56-0x0000000000B00000-0x0000000000BA0000-memory.dmp

Download

memory/3348-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3348-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3348-21-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5464-14-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5464-32-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5928-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5928-53-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5928-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download