urelas | 9c4c9f4784ef74f8c43293f7baa890a69114c03e46e4d84c4fc0680ffc51fc00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 302KB
Sample260905-mk2thadc59
SHA256 9c4c9f4784ef74f8c43293f7baa890a69114c03e46e4d84c4fc0680ffc51fc00
MD5 548fb7d7a32ea8670d2fe2cfa5be3a82
SHA1 7a6a05100dc3c63c2b7f24612cad53e9d303545b
SHA512 b5b8a0f8cee2d7fd866f7e8915e5991dd8142cc74e30dcccdf79785e1eb14d5768a5bb5478cad439459c0cb7b425c01c9c0ddda8eae4f11c3ecb29722730fe4f
SSDEEP 3072:dQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopB2HO:dQi+reSUbnbA8VKQq8hpW6p75PpBb
TLSH
T141649C103980C4B2E76A07310446FAE44A69AC3E1B95E58FF7787EB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cuxor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	neehho.exe

Executes dropped EXE 3 IoCs

pid	Process
4176	cuxor.exe
4944	neehho.exe
4424	rogyz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
552	cmd.exe
2444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cuxor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neehho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rogyz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe
4424	rogyz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4176	3040	2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 3040 wrote to memory of 552	3040	2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4176 wrote to memory of 4944	4176	cuxor.exe	91
PID 4944 wrote to memory of 4424	4944	neehho.exe	102
PID 4944 wrote to memory of 2444	4944	neehho.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_548fb7d7a32ea8670d2fe2cfa5be3a82_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\cuxor.exe
  "C:\Users\Admin\AppData\Local\Temp\cuxor.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\neehho.exe
    "C:\Users\Admin\AppData\Local\Temp\neehho.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\rogyz.exe
      "C:\Users\Admin\AppData\Local\Temp\rogyz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 f6e877f752b944119dae33c711ca161f9938cfbf8e8ca9936862825cf13902a3
MD5 381f0f93a9c773d9210bda22848eda45
SHA1 2ac8bccec2d2a51bf623c3c8721180a7dea95f5f
SHA512 9ede9bf82ab4c50f9ea1b532736a0fc6471ba35f3f6ff959f6d7a4881860c07328152f92cb7e160afb9333ea1d610f8653b0b78a8bfdea70f556bd7b65f7bd16
TLSH
T1ABD0C71242D7DB6E0448906F06B661CDC0795C5C3F473F11A721C44C61C141DF6C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 02e194efab0f0fc29d0310eb59c19ca37eb547150c3ba5c8a5941edd6100cc09
MD5 401f537c821283a5a2c9fe72dfb48cfb
SHA1 300123bd5f7e216856f98409e4cce2c55bc5bbba
SHA512 0adabe260f697913589b061871c3dfc0a4e67935891241f095d607a650c7dda944cb88bbf8eb5478cf4e2a5ddaa2bb4b6f200889a2c8be63c138516720abf769
TLSH
T186E09206225AD96A000CC01B05E1764DC150DBD9BA873BB17620C55D61D241FB597663
MD5 SHA1 SHA512 TLSH

Submit Download

cuxor.exe

Path C:\Users\Admin\AppData\Local\Temp\cuxor.exe
Size 302KB
SHA256 93fea707f5362b8aff246b8db0e639d6bcb8e5ada20e78b5f3a36e65d9c0623b
MD5 04d02c54010adaf759c1e218b7ba91e6
SHA1 34db4c8226840b8189ef4eb8d26dea7e152a197b
SHA512 d97b26152c72571616be4f1ffe0e2904480cd79e12edbed5e8b96c83bf3c2656177ff0110a51b5c35c19742d2dcef299ad2e3405c83f29f6e1757b6cc2348235
SSDEEP 3072:dQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopB2HU:dQi+reSUbnbA8VKQq8hpW6p75PpBn
TLSH
T107649C103980C4B2E76A07310446FAE44A69AC3E1B95E58FF7787EB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d9a1143617b44f5ab63f02430a89b76cab98215fd94eab28459365076519058c
MD5 bafb86a7b4575be6529667508d83e860
SHA1 fbbae86dde8e46e1c71c4d0643f9ee3b33b1ae9a
SHA512 6bf0aeb832fb76946f8c385298a5aa74323ba11c7ab159c65ddab19d5b733dbd18349789330b7b65e4e1d833a2d76b2fa62bb1cc1966d483cfa16addeb2fcaf4
TLSH
T131F04CD610B1B142B516F623D3841BD117931D9969839C940168B1715975A6CC4D4757
MD5 SHA1 SHA512 TLSH

Submit Download

rogyz.exe

Path C:\Users\Admin\AppData\Local\Temp\rogyz.exe
Size 111KB
SHA256 8cdd225906778b135d38f792107c7226ede455c4393a3b754bb0f396f922a9e6
MD5 d10598367616dff6184cb66c42597c10
SHA1 827585c819927dafff4512f663a6961dd3d1f4b8
SHA512 53fe33d67f1a7b721bf35be216e32d07c6c52cb90df8f2a74323258027957194874b875ec123309f207a956cbc3a1b3adbe477ea4c21fd16bcdec9fb1f83a286
SSDEEP 1536:jH21ZVCMSo4l3nhZgnDuJsJV1/1WpkUCVBZXwvZ4Xw93DgNp:jWrW53nhZSuJ21/fUCHhwdDmp
TLSH
T126B3D043A60084A8F71C0B311942F9E054A59E3C69E9F50FF13C7C7AB9B21975AB319F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3040-16-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3040-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3040-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4176-14-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4176-26-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4424-47-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-43-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-40-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-48-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-49-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-50-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-51-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4424-52-0x0000000000800000-0x0000000000888000-memory.dmp

Download

memory/4944-45-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4944-28-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4944-27-0x0000000000400000-0x000000000044C000-memory.dmp

Download