urelas | d4b421f68e269c7586947aa64468214f0e0e0ab2f81a0649c3c50e9ffa42ee4a

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 402KB
Sample260823-e7ptfssfrh
SHA256 d4b421f68e269c7586947aa64468214f0e0e0ab2f81a0649c3c50e9ffa42ee4a
MD5 95b17d256f8d6057bdbb1e38246f1f55
SHA1 2f0d21740012192d450ac7ef935a15238ffea01f
SHA512 399428b0f6092c80ff59855ea222c8d266f5dcd8f1c548cc97ac6054a79f72da23f69a34de70b50a5bf7accf75a0147aff238997033fe26c39fe68813e61f0bb
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTv9:yIfBoDWoyFboU6hAJQnrs
TLSH
T12694BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3928	qufij.exe
6080	igboyc.exe
4972	kyojg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
4204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qufij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igboyc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe
4972	kyojg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3928	4320	2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 4320 wrote to memory of 4328	4320	2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 3928 wrote to memory of 6080	3928	qufij.exe	92
PID 6080 wrote to memory of 4972	6080	igboyc.exe	94
PID 6080 wrote to memory of 4204	6080	igboyc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_95b17d256f8d6057bdbb1e38246f1f55_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\qufij.exe
  "C:\Users\Admin\AppData\Local\Temp\qufij.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\igboyc.exe
    "C:\Users\Admin\AppData\Local\Temp\igboyc.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\kyojg.exe
      "C:\Users\Admin\AppData\Local\Temp\kyojg.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 894b884346607e2da470b6dd8f9948d6972765cb827865feeea15eea4f7cbdf4
MD5 a80aec434d6e4d5e6564aaf6d2fbe161
SHA1 4fe4a1c0017abc964d78f38213e3efea362caeb8
SHA512 8c87a8693c32bf3e5decb69ae5d2716c5873942c10673f600be7c6dd5fff20dc93cc3888e38152d3d1a9ade687939cd67d86b0ea994af40c4109b9a7e7139440
TLSH
T1ACE06D2101EBD92A040DD01F56A9FACF915465283E873B786610C35C92E584EB4E6212
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 19ef7fb61dd69cfd722ba05c88f7c423e24f1bfa8f8953a97b3075291f71f089
MD5 894ba994a13fff40b553215eb4f5329e
SHA1 8d78f65a80eb6c3ef39d6b4e762385476141bb26
SHA512 8c2991e519a6ee361075ed50baf631a29339a7ae4d7df5742a4a44d0d324fbd0b4c6240e96b59d82611dbf61873c4e3bc159432901b624749ce6c4e8309ff9aa
TLSH
T10DD0C71149D7D75E0448942B06B5658DC0758C9C7F477B119722C84C71C582DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a2fab59f1c6d3a2c6d71344ddf6ffc7499698b9505cec806b5f0b412b4c67531
MD5 d590904d9f84cd3b120bc0d247fd5802
SHA1 05c13e61abef7e8bc45422691a2ec55c2cac31c6
SHA512 0e90a84da6fac4d120ad40fa5c4c27d836c370ca8b7f251b21d15f7a14591e820b28bb4bca8908c781c4215dc89c5c90fd2aac68e9d52532f626e82eedb6980c
TLSH
T1DFF08CC92060B059751AE202D6C4077027830C8418878C880004F1205A3482C8948286
MD5 SHA1 SHA512 TLSH

Submit Download

igboyc.exe

Path C:\Users\Admin\AppData\Local\Temp\igboyc.exe
Size 402KB
SHA256 258797d1ccc4f4470f1fb9e7b5571158431fae5270c3f2cad47886d653d61f86
MD5 de0224cc4d7fe243530dc363b148db83
SHA1 be655dfb14a416bc29af307315f32bb9268fbea4
SHA512 96987db6b5b03a2771f69a74f71b98db80d160534515f8a45c5432842a31c61caa1c36b8917c7c4ed212c3e6eb2e7bca7f3e7cf6e22fb408ed77eb1a966fe9c6
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvU:yIfBoDWoyFboU6hAJQnrz
TLSH
T1EF94BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kyojg.exe

Path C:\Users\Admin\AppData\Local\Temp\kyojg.exe
Size 223KB
SHA256 21b81e7d29985bbed6cc1b445876e64415b511d9c05c577a1751fdc6d017d7cf
MD5 7ff0663b968ff979b74e4faa9234d136
SHA1 4b2dd271796612b60ff2e85d23da45d2b1fc8e99
SHA512 6c8a7baac1736fb56710acbd8b703f2a4913bdb49a581f7b10ba78069ab92cfbaf21218c8c501f19d61de80fe7476354b3e58bbd54078a1a2b1bad8a41ce1389
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3e:unFhSIkAyDgjtS/FZU
TLSH
T1B224E042AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qufij.exe

Path C:\Users\Admin\AppData\Local\Temp\qufij.exe
Size 402KB
SHA256 66668a6b96d54bd2cda2da661d289195dd93da165dd92b687044810348ec1a2f
MD5 02c5a38f07dcd73b20d09c79222cb75f
SHA1 feacb25fe54d5293020022b66ed1e0444181d1df
SHA512 07ec39b1ec97c7f13f35b8d1267098a120a080ba7d2f787bb9ead7b963c5d86fa99002e0c46ed8c621c385e7264014ffbeea0c16576af8738dfbdfab066cc287
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvN:yIfBoDWoyFboU6hAJQnrG
TLSH
T14B94BE253140C436F32A0B354456EAB049A9BC3915D9E48FF778BE7A5E311939B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3928-18-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3928-31-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4320-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4320-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4972-55-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/4972-44-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/4972-56-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/4972-57-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/4972-58-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/4972-59-0x0000000000080000-0x0000000000120000-memory.dmp

Download

memory/6080-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6080-53-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/6080-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download