urelas | b00ca8b51a15a7c822ca88bfaf1e194ac1c28d611bcc5cf7267a6f74b515ee96

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260820-1791aazwex
SHA256 b00ca8b51a15a7c822ca88bfaf1e194ac1c28d611bcc5cf7267a6f74b515ee96
MD5 0a9631fe2ebfb234de689dcd14b156ec
SHA1 a5b0c0272206ce2d5f6c5f8ffced29fd4885301b
SHA512 4a2a4808e215b8315cdf7dbae2c5cd495303d4ba8fb875bbf886be4f193adc3b31da3f958152a9ea61dcff86723bcaa4de21bc1c7c666447ff25f392937cbe76
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMV:AIfjoga6u1AVDV
TLSH
T1F465D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
616	kygex.exe
828	giqagi.exe
1676	wihad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe
6496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	giqagi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wihad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kygex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe
1676	wihad.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 616	4924	2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4924 wrote to memory of 6496	4924	2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 616 wrote to memory of 828	616	kygex.exe	93
PID 828 wrote to memory of 1676	828	giqagi.exe	95
PID 828 wrote to memory of 2776	828	giqagi.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a9631fe2ebfb234de689dcd14b156ec_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\kygex.exe
  "C:\Users\Admin\AppData\Local\Temp\kygex.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Users\Admin\AppData\Local\Temp\giqagi.exe
    "C:\Users\Admin\AppData\Local\Temp\giqagi.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\wihad.exe
      "C:\Users\Admin\AppData\Local\Temp\wihad.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 ce6b5c9b2992942f3b47f41b247f89b2ec64155a2276325555cd6016c102552d
MD5 b65af51d4f4c6fd8c7188f8b4a7b5629
SHA1 3a4f7de6c675d3dba45fd788f6c5ad1a4833676a
SHA512 17f7d23899e69fddc277148809ea3c228075256339fa414325ebea280d2b31e76a4608c4460ae0549edadd0098e84eeb737f12a5266682824581eaa182d02f31
TLSH
T1B4D0C71141D6F76F0458902B06B5628DC07D4C5C7F477B11D731C4AC21C541DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 444B
SHA256 24f64c6bc3351882cc0b86dfc3cf73593ae5039ac3901e446096bbe73d12085d
MD5 ba6f54fffd4ae0d59b503edba99a363c
SHA1 bdb30f61d4adcf502398eb5907f930a1135cb913
SHA512 ac225e9340c1ee6ec98c8c5acdc52834412d085f17f987b6e202766a904e72ce44760989280cd6fbc68d70107b77fd28b553fd6950bcc7c8d6741c46beb33396
TLSH
T1DDF0A00105EFC92A0D0DC01F85A9A58E90A4DB9CBE863B702620C60DB2E589FB1E2252
MD5 SHA1 SHA512 TLSH

Submit Download

giqagi.exe

Path C:\Users\Admin\AppData\Local\Temp\giqagi.exe
Size 1.4MB
SHA256 d3b78fa9669c02a4520421c7eba0ab906ac35ae655b14fec8441dc3e43338c41
MD5 a4e1540bc25df06f8942e7a0430180b1
SHA1 f8318643c4f81428f7ebb2c467be4e5540cf74ec
SHA512 b561a428b8387f1e5cca87b79a1c1e8899440308df4f99e3091900fb0fccd16b64e3e63d27a1d054b8c83e9ccd4facb2245444e908363962a9436f8d635f4e81
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMk:AIfjoga6u1AVDk
TLSH
T14165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 15acc8d83f82db2e100276d6339d6cd2fc795b070f381edb492c599681b3caad
MD5 34de58313f9a1994e65ad43f31213876
SHA1 34da3426033fccc544c427bf19d672bda375d014
SHA512 348bc5baa5609560b392b204109a0a4a2ce8f6caefb145617add77f65064ecd2f6d8729423c406e4b32c73f1805e6d70e7fe61c0b68c3b519e7dc552748627f5
TLSH
T165F04CD5105AF0493616B613F39907B927831D842B97DD500104B1305D79DAC9858B55
MD5 SHA1 SHA512 TLSH

Submit Download

kygex.exe

Path C:\Users\Admin\AppData\Local\Temp\kygex.exe
Size 1.4MB
SHA256 58e5a39bdbf71063fe50493ab08df76ba19b88276cea199e8e60d0acf691d270
MD5 c49c8ddc3d0e5e76597e8ffe689cda0b
SHA1 5897befce0b880bf66719e57ede00ab0cb62a156
SHA512 c5cc347a1eaff79f215351877dfdf2382eec5847c99d4cb1b9e8d5c9bd15f4b2eca410de74055f249fa0b75ee8e1ddab51ea8c128eaf227654d780efaa1dd0b3
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMM:AIfjoga6u1AVDM
TLSH
T1B165D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wihad.exe

Path C:\Users\Admin\AppData\Local\Temp\wihad.exe
Size 223KB
SHA256 53c5fd26309326d793fa067fc6a4c7eff6aae15c2a02c60cbc74d64697bd1ac2
MD5 d83abcfc8391402131b7f5e0057ac66c
SHA1 213ed13d0b3ed2dabb407f80ad0b7faa85e188b1
SHA512 d4b2ce2ac33b6799e90ef9d2e946c679f65c54ecd29f3d0814278404fb9bf599d284bcc2e8bd8869cf8dca86ba79b37b9a6817b4c8fea1866845f457f5ffe103
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3F:unFhSIkAyDgjtS/FZz
TLSH
T17324E042AA018888F34C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-35-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/616-13-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/616-19-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/616-33-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/828-56-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/828-34-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/828-36-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/828-37-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/1676-47-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/1676-58-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/1676-59-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/1676-60-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/1676-61-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/1676-62-0x0000000000AD0000-0x0000000000B70000-memory.dmp

Download

memory/4924-22-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/4924-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4924-0-0x0000000000400000-0x0000000000570000-memory.dmp

Download