urelas | 495fd1a81c789ae5983fa04742b75f11af0e823cd4674ec6147b1948394c6892

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe
Size 212KB
Sample261001-bwpsjafa47
SHA256 495fd1a81c789ae5983fa04742b75f11af0e823cd4674ec6147b1948394c6892
MD5 fb998fab1268567fefd32374ccd35ec8
SHA1 d67afabfc2e370041094c7351330aff53f2b6e57
SHA512 4c7460ad9d332eae671dcb59a4a92c8d478a9700fd96ed2ffdff587549aac02399a77407d488f6da140329da8156e7c496800171426377bc5461250f2d07fbf8
SSDEEP 3072:RAD80Wc7UJ6LZMaHLW65DEBppXmykmU9If3h1O4Eb/eONeorO:SVWc7UMLZ9qoEBpVmRXA3+4M/eONU
TLSH
T174245B1176008471F3590B364956FAE14969AC3D1AE8E88FF7787E365E322C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.207

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4688	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1352	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	huter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	huter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4688	3400	2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe	89
PID 3400 wrote to memory of 1352	3400	2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_fb998fab1268567fefd32374ccd35ec8_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1bf9ad4eb9a6ec73fdd5bd94de5ffca1d94a48707f5a2818d5fcd68033cf1101
MD5 14ab4579b6f3a97ff1099d4591f166c1
SHA1 9379aa65d3bfd4f819f06417b90dbc9ec7bc1354
SHA512 a6342bf2172f65e4541230f91249c77e5ef2e558acaa91caec520fc4b2ca2f57a4f687c62227a7d20b0264b41bd88f6ad3d38d23bcf571165693b861232c4ac2
TLSH
T147F0928000A6F16D3116A102E006F77433629CEC050E5C8206D7B365663112C8088078
MD5 SHA1 SHA512 TLSH

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 213KB
SHA256 0dc4488ae90b7151582080c721db055d41dc8a08a7ba51e394eafc89defe433b
MD5 9777f3ff82e09e17112f5280dd009f0b
SHA1 a9fdc292c530b07417b076cd6e2c5e23b30763b4
SHA512 40561bd7bed3d3e9f393d47db7b6a6d4d9f36f078ac07c3098adae28c0853a24f347ff3f4f0b5846dfedf1da928df1da35e4052732e88cd3e96f7a94d3c49000
SSDEEP 3072:RAD80Wc7UJ6LZMaHLW65DEBppXmykmU9If3h1O4Eb/eONeora:SVWc7UMLZ9qoEBpVmRXA3+4M/eONk
TLSH
T1E7245B1176008471F3590B364956FAE14969AC3D1AE8E88FF7787E365E322C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 44bfb58ad1544db1b329aa55d0d4044157fa2fc0454a6b7fb0bc2a26eb3952a9
MD5 46c1b7ec1398200ea87df03c23cbb6b8
SHA1 c5f838648fe907da0e9ef0678fd565e3bc9df681
SHA512 471e23b1f63a602f2442303ea4dc41c50c51abc3dd95993a1607204437c8f8930cedef44806fd7bd89b8fd96f6bc40e2953b905df77be6c375dc266cea6c8d34
TLSH
T17AE08610619EDE1E091D601F86AAA24DC6606A9D6E8B3B11D731CA9D35D560EBCD3313
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3400-0-0x0000000000F50000-0x0000000000F88000-memory.dmp

Download

memory/3400-1-0x0000000000F63000-0x0000000000F64000-memory.dmp

Download

memory/3400-21-0x0000000000F50000-0x0000000000F88000-memory.dmp

Download

memory/4688-12-0x0000000000DC0000-0x0000000000DF8000-memory.dmp

Download

memory/4688-18-0x0000000000DD3000-0x0000000000DD4000-memory.dmp

Download

memory/4688-24-0x0000000000DC0000-0x0000000000DF8000-memory.dmp

Download

memory/4688-25-0x0000000000DC0000-0x0000000000DF8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads