urelas | d930fc838cb41c15b73ffd22f652f1da7eb317e62d730826113715d48bd41667

Analysis

max time kernel
149s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 594KB
Sample260824-mphanawekb
SHA256 d930fc838cb41c15b73ffd22f652f1da7eb317e62d730826113715d48bd41667
MD5 60a9739420a6d789b051e7af83c49726
SHA1 5c23626b8feba47a303696cb393b88b4a3d49cc1
SHA512 2b92bbdda1764b1430381b81ddfc09ae826bbaae161420e61ae235feba4d235fe1a4c691626be0bedc99fc2911cb486b11f7744b681f6d6750fa832fb54bb4bf
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFMB:8MpASIcWYx2U6hAJQnhB
TLSH
T1EAD494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
924	doesi.exe
4892	pugehu.exe
5032	esozo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3188	cmd.exe
3252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pugehu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	esozo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doesi.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe
5032	esozo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 924	5220	2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5220 wrote to memory of 3188	5220	2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 924 wrote to memory of 4892	924	doesi.exe	92
PID 4892 wrote to memory of 5032	4892	pugehu.exe	93
PID 4892 wrote to memory of 3252	4892	pugehu.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_60a9739420a6d789b051e7af83c49726_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\doesi.exe
  "C:\Users\Admin\AppData\Local\Temp\doesi.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\pugehu.exe
    "C:\Users\Admin\AppData\Local\Temp\pugehu.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\esozo.exe
      "C:\Users\Admin\AppData\Local\Temp\esozo.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 4b65a6ca4f990143187ac219b2f9f0cfad384bdb67f558c2637cb0b0f62f0f27
MD5 bd111311a87efbe5ddcaf461c93e7be1
SHA1 ee6335ccde923ff14e72968244024b4d704c51ec
SHA512 ad6ec1f02e8579c024238b19e332d75d723676f63e5205e928f63dce75099923885301cd9dce64e4a9849c254ecf2768bce8eb811d7cd2ebe299423ba23825ee
TLSH
T12CE0220001FFDD2B080ED00F02B8698EE16696183E8F37313220834DA2E589EB1A3203
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 06eb9ee3d59caf247f5b3c73514f8247091bc75026ac01a59245d22d5fe6aa73
MD5 2e50591bcd02d8916300d835795226cb
SHA1 ff5cd5d20321b77453cacde7e2a781be51ecaa27
SHA512 a78ac61473aa4e7cdead9fe12d639bd3cdf3c046022675f780be3d5d63a5d77625ca22a6e30e0989c0dc75139e6f444d850aacee4ca0f4957ca351c023291836
TLSH
T1E6D0C71141D6D79E044CD46B0AB565CDC0B54C6C3F4B3F15A721C44C61D541DF9C7741
MD5 SHA1 SHA512 TLSH

Submit Download

doesi.exe

Path C:\Users\Admin\AppData\Local\Temp\doesi.exe
Size 594KB
SHA256 c14e648be4e6ccff56208fff35b08cf006fa27cd2c20cfdd893bbc4d2ef72597
MD5 749f12f0c64c4496f103340d107d54d2
SHA1 1e94668836d5ca373277989edf06cd25239b1189
SHA512 0d0bdafd79263c9e83450c5f8d317c881c5080f523802cc8ea226613067c3c43100ecf269c10b2ffc951de4edcaf6d343bb4c613f9da3fb76cf25251a0a3fe10
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFM7:8MpASIcWYx2U6hAJQnh7
TLSH
T116D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

esozo.exe

Path C:\Users\Admin\AppData\Local\Temp\esozo.exe
Size 223KB
SHA256 382c510acee355b6e1e20535c3ca96f60cee4cb15966d0c033f6d846165933a7
MD5 acbaf7764bcd3f696856d2264a730a7b
SHA1 841c7e9db6f696731a1c6fd185b928a1ff2537e4
SHA512 565bfd60ea13a512f83d2c5ccef9c582fc839389bbd9925eb7d0e37576385a008d0cf72d00b1bb30a631c404ee4ed9d17c175549f8f5a415ad170b86d42e211f
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3q:unFhSIkAyDgjtS/FZg
TLSH
T12B24E042AA018888F34C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d9ac8914761b3236fbcb02cf6fd0cc176c081e58b76e9004bcc03ef52d9df87f
MD5 ed9973f8258192ddfdf448506e956292
SHA1 ac2d6f76c994f6f4bb011bf37851cc37ac970218
SHA512 8f565201d1692113a306cc55e623abe338770a24ac480fb4bf367f3ecf90fdeac5e0183397f0b7c800de91f804ec443943b4ae8248cc5c16017c679ab862e013
TLSH
T175F04CD51171A0597612E523D3951B951B935D9529879D980204757189348BD844829A
MD5 SHA1 SHA512 TLSH

Submit Download

pugehu.exe

Path C:\Users\Admin\AppData\Local\Temp\pugehu.exe
Size 594KB
SHA256 f03878e37d7b00b392e2954fd45e54f49d70967b5a1eb63c886f3035a3bda3bc
MD5 3bd13a6a83f1fcd0bf54c57bd5bb5fb1
SHA1 ced66955776849928fb64684167cb9fac4eeaf24
SHA512 07576c3db5ff2ee3da7cdd6c55caf0a58be1167121637895034699d36213111893d0dc8b9b2043d19b5e567eff3db0179a36e4daaf4d5a63bdc7b6dd3dad9e81
SSDEEP 6144:8EK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpdFM2:8MpASIcWYx2U6hAJQnh2
TLSH
T114D494685828C8D6E795D534E82CEB1596F48CF17B8300ABB076F9FCD4B22D161AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-31-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/924-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4892-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4892-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4892-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5032-44-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5032-55-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5032-56-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5032-57-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5032-58-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5032-59-0x00000000007B0000-0x0000000000850000-memory.dmp

Download

memory/5220-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5220-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5220-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download