urelas | 3fa128c4a8d0121fe80ad975536f08b86eaa1400d9df05224f2ff55294d0b64a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 353KB
Sample260930-ldx2ass14p
SHA256 3fa128c4a8d0121fe80ad975536f08b86eaa1400d9df05224f2ff55294d0b64a
MD5 96ec0fd6e36e632cc837482ff2ae7b94
SHA1 41a514dc142fa90417da54c101739b7f646e0a14
SHA512 e10c6d97b19edff2eb0cf80f3d5c3c514640a4dfb3f05fc0d9640c8df6e42f387017f8641f63b32f891231e7b4bb7c7e21e3139db0e862469d9ca51b01e58aae
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZ2:wd7rpL43btmQ58Z27zw3eZ2
TLSH
T1F8748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
3816	vipoc.exe
4564	ahvumo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4168	cmd.exe
2884	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ahvumo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ahvumo.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vipoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahvumo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 3816	5656	2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5656 wrote to memory of 4168	5656	2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3816 wrote to memory of 4564	3816	vipoc.exe	92
PID 4564 wrote to memory of 2884	4564	ahvumo.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_96ec0fd6e36e632cc837482ff2ae7b94_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Users\Admin\AppData\Local\Temp\vipoc.exe
  "C:\Users\Admin\AppData\Local\Temp\vipoc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\ahvumo.exe
    "C:\Users\Admin\AppData\Local\Temp\ahvumo.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 395ad42a5fb64435723ead2bab0cad1bb110dc88e83f8fdfdcdc24d85e064f7e
MD5 01212fb5ccfdfe76356226c2af100adc
SHA1 becfa2d65c186eafbea246614c6bb9a9b2a64309
SHA512 79a0dc92b2d6c456b36146d23a87a04252bb7ac1a918536509fc8cd467436f1f087b8a8a17e31907abd4d086f0775876a19ce5cf269130f0632c48468074225a
TLSH
T1C0E0D88581FFDE6A000CC01B8AA1E6CE816456587E877F207665C25C12D652EF8D3352
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 25aabf03f97b8c10816d0c1572c8d44dbc7a275a8dcf29d128236d51d24b9b73
MD5 c871711cfc12f6f68074fc841d6b1b98
SHA1 f3c974c6e7c1e69bdef8e3d11100f905b5416868
SHA512 18c88b0d9186f93e9507b9d31fb83de75fc8403c2d46df8e100813612d95289758026ca6d865c9ade87bc2f0abb76c7b9e5b045c102078cd1358c56cd1eb3f00
TLSH
T110D0C71241D6EB5E1458D12F06B563CDC0756C6C3F573B159721C54C75C541DF6C7741
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 9aafea34c5ebc80510fbc3a4f813b28ae832d33fd2c2de744ccfddcc62ec3229
MD5 55938c47daa19d342956a8a3eadb2128
SHA1 af94f11f8833eaee23feedcef93fc16344e5af79
SHA512 53abad3744eee26878f1eec04879bd2039d44efd8fcf9aa9d17ec15fd71018c762b7142ad521fd5261075e1424dc15e7198fbe5e409fd98d2a2030665065cb60
TLSH
T1DCF09BD510E5F0D53913F711D3E56F6417932DC81B47DF944405B27069F5CACD584355
MD5 SHA1 SHA512 TLSH

Submit Download

vipoc.exe

Path C:\Users\Admin\AppData\Local\Temp\vipoc.exe
Size 353KB
SHA256 2f98bc819c05e0cb99ca65f4ac8839ddd2c2a1535cfb33b43c8df56778d5b7f0
MD5 94b2a9dcdad5444060ccb1b547296b45
SHA1 2b0ca488ba9399e69f4d23b269f65caad9f6c36e
SHA512 8a248dc9b064f99c2e201687c3b0e8d8acb249e81e5bbbf38cd1705df8b089d40e3f5db9dbffc1cc028f274a6047d537413c95da3947ea2fa0f2024b61e44d05
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZF:wd7rpL43btmQ58Z27zw3eZF
TLSH
T155748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3816-14-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3816-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4564-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4564-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4564-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5656-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5656-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5656-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads