urelas | 8896f71e89d2b173efb123216e54f9b033e26b1839f95ce6ceae002c0b47f639

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 05:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 356KB
Sample260820-frbsbssxdv
SHA256 8896f71e89d2b173efb123216e54f9b033e26b1839f95ce6ceae002c0b47f639
MD5 f5666c17b21a6b16fe74e0cb61af0ee2
SHA1 eb172681dac5d8240ef96e3ea60bf7f873e54bca
SHA512 f993c366bd27b1dd4b8bfdf60b03794189f4e299311070d68d45d2389b2a7eebb8c2d1dbac3fd206a97e935cc5b56c96b0d98b6efe0e5892aa3d8ea7e38e2b65
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzq:wd7rpL43btmQ58Z27zw3eZzq
TLSH
T10E748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
1836	puvuj.exe
280	gogyce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4684	cmd.exe
916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	puvuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gogyce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 1836	5516	2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5516 wrote to memory of 4684	5516	2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 1836 wrote to memory of 280	1836	puvuj.exe	92
PID 280 wrote to memory of 916	280	gogyce.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f5666c17b21a6b16fe74e0cb61af0ee2_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Users\Admin\AppData\Local\Temp\puvuj.exe
  "C:\Users\Admin\AppData\Local\Temp\puvuj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Local\Temp\gogyce.exe
    "C:\Users\Admin\AppData\Local\Temp\gogyce.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 ce07d2d169753131dd1c4c7eecb85b323a5e95344301163df7d0acbe84a55232
MD5 3fdf42cb68fb8620ab7d781111116cb6
SHA1 3b9b5ee21375f8da76e3fb97fece70551e8cae97
SHA512 d3bf0fa5b68fb480b594a3c08737fa3d58f2885fb17ff7c8603d9a6f3fa90408dc4ca6ad8e7c4d0911fdf91c239f3fc22e76f890bfe11c3bb611bccf527791b4
TLSH
T16EE0D80502EFE966090EE02FC5A1754E856496B87F8A3B227615C9CC22D580FB6E3702
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 0d6072f05532f993a2c9d0f4595c60554f811b00f7562a0e5eaaf56714cfae20
MD5 b04d4b2f51e9c117b65eb08fc702dbc3
SHA1 6d122b3e1064c23c1c6e52a44f725e7d0d30b7cc
SHA512 ff6f957879706e12212f2e42de2a7c180805d483a7f64d2c1888243db9ef8aa262babe6746c26d28a159d9ae4bc5921de6e5671e73bebcae29c633008858c7be
TLSH
T13FD0C71245D6E79F0448903B07B5A18DC1B54C5C3F473B119721C44C21C141DF9D7742
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 00393ebf4c4b10703b435138a811a9cc0bcbc32e22662c76045b0e47bd504b2d
MD5 c1ade696f7a368bfb78d9ae985172f96
SHA1 497d27bcfb5fe1e3e84dfa0e4627f81626c65536
SHA512 d4ee1dfef351376483609089a1084306dbe858221b63b30e168802d2a43d9a49ea732074d261e2bde05b2cb143dd1704bb29f34db7aed6e8131a5b31676621c7
TLSH
T180F09BD13065E0863622F613D38467D513D31DC42F87ED84410972B4CD75CEC440C755
MD5 SHA1 SHA512 TLSH

Submit Download

puvuj.exe

Path C:\Users\Admin\AppData\Local\Temp\puvuj.exe
Size 356KB
SHA256 9e50a3c20b09f00667d6cd335bf5904e032f69365c1a95baff2a10a49cd840f4
MD5 948cd73145115ebf197e2dea13323fdd
SHA1 30326d0e99180bca33c66c9b9b595e2363ecfc24
SHA512 158a2f521df89cc9d935cbb1665b7996b743c0e38ab265768608de155df7f467209b6df03c91e6a05977ae289bb8dea7d9910a74fd5465f257bb1199280cc51f
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZzv:wd7rpL43btmQ58Z27zw3eZzv
TLSH
T1F7748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/280-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/280-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/280-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1836-14-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1836-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5516-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5516-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5516-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads