urelas | 58859397582ba1c26c56774012cccb4885a73678a3a57ae4100d543ede5cb04e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Size 366KB
Sample260904-kfp8sseq41
SHA256 58859397582ba1c26c56774012cccb4885a73678a3a57ae4100d543ede5cb04e
MD5 5c6969559ba3fbc30d1ea95dbcc88467
SHA1 65fc017145dd42d5432d2a2c32d381b55d575c8b
SHA512 296ec493e50374b11bdb237a5a8363816771a3c0380ef59df70381b28426201c992fdd43ad4080d0d6ccd37450c15b71750a42b8058a82c55424de8f2c5313cc
SSDEEP 6144:Eivd27I1O8aYQ7ATa7QT0KXCjLusuX0iZv7i04NTaRSKkMZP7KTllpOauLZHn8or:Eh8/BQ7Am7QzyjL80iZm0savzKTlHOaE
TLSH
T14784DF217250D03AE3650B3198A5E7B55A7DBC3910A5954FF3783A3A9E301C3AB3729F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
932	wopys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wopys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 932	2464	2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	89
PID 2464 wrote to memory of 5852	2464	2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_5c6969559ba3fbc30d1ea95dbcc88467_amadey_elex_karagany_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\wopys.exe
  "C:\Users\Admin\AppData\Local\Temp\wopys.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 392B
SHA256 1fc08a6d5009d5f0eef8d3f62831074c67e97bf95b38e4affd7dc14e7568f840
MD5 b64acca8b494e8c3ebe6381e2622687c
SHA1 3ba8880c915ae75dd5a4448cc1fe8d7b79d230d9
SHA512 54bdca96ddbd24e66eb1380222aca57866a7d17ff2e2c3eca35058892021b75555feda395063f524fbf4efd9efc921e7358f8c87359b5d6de01fabbe0b8270dd
TLSH
T111E09243117FCE5A020CD02B56B0698EC154AA692F4B2761B720C88D62D688FF5E7611
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1bd86716e5644134eb79143b585f3b9396564dda7c22253199da5f7e935517f8
MD5 8e60eec6fa893333604bc63875a8a0f7
SHA1 d30bb95b7ebfff805e675eda03fb9cdbd2efe314
SHA512 22970534557644ab410724a3944a1fbc03ce360b6e81463b1e602a0e12ae78bcda53188cda92876d54ea217426078a1b9149f57396bb6eeeeb451ae6569ca18c
TLSH
T107F09BD91475E0593B16E606C3B4276537D31D941E43EE6401497370CD37D7C4844396
MD5 SHA1 SHA512 TLSH

Submit Download

wopys.exe

Path C:\Users\Admin\AppData\Local\Temp\wopys.exe
Size 366KB
SHA256 cf1e4c955da6c935022e13c60d95fc677d151663345828a2fb9a7d540d5efc7f
MD5 aa14b8b70ca1e60ee1f2f142a14ec0dd
SHA1 524c35f19bca792f7bb0b5fb15cb1ba3b60e11bd
SHA512 962e15b438002002bc3e19b9c2a6cc82d117bb71015e125a092d9bd9cb7df8bd6439c39679303318ef5f30e967b9eceb15d13ba6cc522a23ad0304e70373ba4b
SSDEEP 6144:Eivd27I1O8aYQ7ATa7QT0KXCjLusuX0iZv7i04NTaRSKkMZP7KTllpOauLZHn8ob:Eh8/BQ7Am7QzyjL80iZm0savzKTlHOaI
TLSH
T19D84DF217250D03AE3650B3198A5E7B55A7DBC3910A5954FF3783A3A9E301C39B3729F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-19-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/932-23-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2464-0-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2464-1-0x0000000000419000-0x000000000041A000-memory.dmp

Download

memory/2464-21-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads