urelas | f84e9185fc73ccd7c72b10f8dbb71413882008be7f5664b5b50a4d34c6029114

Analysis

max time kernel
150s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 401KB
Sample260825-2ma6wszdma
SHA256 f84e9185fc73ccd7c72b10f8dbb71413882008be7f5664b5b50a4d34c6029114
MD5 acf7d720920c84824897781f22aec2c1
SHA1 745a35b1c5934d3fe28a786141bfb1bf6ddadd84
SHA512 e1bc65a47931bf7c8fe02e7fe007bb87c6c2055ea003b231e9058385f8c2017df24aa024d008dfa4f7f83ffbe5dbe81a8d206c643b92de3a9ecf3391e06dabfd
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvR:yIfBoDWoyFboU6hAJQnru
TLSH
T15D94BE253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4572	wukak.exe
2524	hijipe.exe
680	ofbow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3840	cmd.exe
1344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wukak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hijipe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ofbow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe
680	ofbow.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 4572	5460	2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5460 wrote to memory of 3840	5460	2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4572 wrote to memory of 2524	4572	wukak.exe	92
PID 2524 wrote to memory of 680	2524	hijipe.exe	93
PID 2524 wrote to memory of 1344	2524	hijipe.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_acf7d720920c84824897781f22aec2c1_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Users\Admin\AppData\Local\Temp\wukak.exe
  "C:\Users\Admin\AppData\Local\Temp\wukak.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\hijipe.exe
    "C:\Users\Admin\AppData\Local\Temp\hijipe.exe" OK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\ofbow.exe
      "C:\Users\Admin\AppData\Local\Temp\ofbow.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 f69da20aed15e2cf14384301e41d5a9a08b21c647b1db5b8f4e9d7a203d9af8a
MD5 6e327ae655a196ba7bf642550b948e52
SHA1 a3454108a957148b92b6808ce7293690223b3cf1
SHA512 49108693f9becf4cc896a3c01f968f47135eb5ff6687e7650768b44ac0267a232ee00de3b70c99c30151f0058c268e3202c1673f1af1275dcbb33fc14551b793
TLSH
T1AFE0220142EFEE3F080CD02F55A96B4F81A4A9183FCB37717611C20D72D688EB0A3262
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 5aa09b523d88d9948096f8002aa140d01f2651a03c10c3bc6585a9be2851ce29
MD5 cfe1bbac0640c1be3870e99bb808d88a
SHA1 9228de24631d43fafbc67841880d48b261e7545b
SHA512 0e3e03b1e0f0062660ddde871a96d8576344ddb4a42d9df7e01e84ca739bca4aeb10fcbb46ed47ed07c772d314ec3c9ad495cf8350e00d8057b258a81189610e
TLSH
T1B8D0C71181DADB9E044C903B0AB5718DC1B54C6C3F873B11D722D84C21C141EF5C7342
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f314921fb469d9b09b80fa950193ca28d876a83e95a5467835094dfd36133c03
MD5 399b109fe146a66f7e12a748ac39ddc0
SHA1 9ae63b6c2b470a4befb1b95350dc98e2f4bd6b36
SHA512 5dfa843912f622d028abb722880744a45919ece99bdef4441089f89289d68cafb1b5e138061809dd3a6a895018a29542219f95343ccc1281bc213aabd2e8d989
TLSH
T1A1F09BE92465B2553711D606F3D8076F5F831D98158B9C9C452571714D79C6C8444356
MD5 SHA1 SHA512 TLSH

Submit Download

hijipe.exe

Path C:\Users\Admin\AppData\Local\Temp\hijipe.exe
Size 401KB
SHA256 ca7341840a187f5def9811bd8fea801b70e004d90c38c12f7999d9e16969f63c
MD5 1296b572ec03ce03c1c332d1ab4d3a77
SHA1 3c4e2448b9cd88a6c89aa4e15ea303230bf7f697
SHA512 a560a5873c89d6a84f894b6796991d905449fed07298f004d1f3a74a95e4f97b4961a53986552ed62c7cf0efc5e14622658d7afa77deca7ed48bd0ff8e0069dc
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvK:yIfBoDWoyFboU6hAJQnrF
TLSH
T10094BE253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ofbow.exe

Path C:\Users\Admin\AppData\Local\Temp\ofbow.exe
Size 223KB
SHA256 7964396a28fef35888f457f14498dd8afffd1592197ba6f6e1dde443070006d1
MD5 fffe21d3d3657eabfe3e45f9c4f15fad
SHA1 a0627448ba7ded32dc4bf97cb3a44b8a174a4845
SHA512 9b4b6c91aaab5cce630276a6e63f42530736c13f7b1cd831b62d53cff79b235503b034de249e273fd9a43c4ae54d42e966ffa5b4fd1f6d7eec7268f4eac4b27d
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3T:unFhSIkAyDgjtS/FZZ
TLSH
T13D24E042AA018888F38C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wukak.exe

Path C:\Users\Admin\AppData\Local\Temp\wukak.exe
Size 401KB
SHA256 83df31526d3af5902546d545e7fff4e7d82c67a41478f07b5bda4569a698e692
MD5 7de223ae69377129da952100a4ac6ff0
SHA1 5308a831e171046f8fb7cf946029dd6329046eca
SHA512 76eafb66d591f83591caf3a04c803760b51f1908bb9712b692a3dbc0c3a1b1eadd307813b1d757a9f3d741f63924e6aaa90432b3a85e654ed1826ee3b7591131
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBwLTvQ:yIfBoDWoyFboU6hAJQnrf
TLSH
T15E94BE253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-59-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/680-58-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/680-57-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/680-56-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/680-55-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/680-44-0x00000000002E0000-0x0000000000380000-memory.dmp

Download

memory/2524-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2524-53-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2524-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4572-32-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4572-20-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5460-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5460-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5460-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download