urelas | 07aaa5b40fe580f47c330b6b3731f52ceb93c435f570ce0d78da5551b92bb1c4

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 621KB
Sample261006-3mlhashv2x
SHA256 07aaa5b40fe580f47c330b6b3731f52ceb93c435f570ce0d78da5551b92bb1c4
MD5 5d8d2b5d3d20dbe881718e55b25839a2
SHA1 a4a953fe85a0f08c8dae2ef5d8a71f1cb8486a3f
SHA512 60dae576db9a7932e9941cbbb78b16c4499f90ab24c250671dbb88a0b6adaa9f1c2f7861c9cb943d6b6bca321e13187c3f4ab050bdf91bd7c8d0544f45daf516
SSDEEP 6144:Mo3wRi+1Py3V0a2WkzSnwR4t2vJrYzfBmpho67hLF7ms2YJz7EZZlznhG6Jp2Bz:/af1PyKa2JRs2UsJ7is2YJz47lzhG6A
TLSH
T14CD4AE2172808035F76A0B3059A5E6E4086CBD3917A4E58FF7787E3A29B01D35A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	ocobg.exe

Executes dropped EXE 2 IoCs

pid	Process
1724	ocobg.exe
952	bebuj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3772	952	WerFault.exe	110
2100	952	WerFault.exe	110

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ocobg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ocobg.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ocobg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bebuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1724	1080	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe	92
PID 1080 wrote to memory of 4832	1080	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe	93
PID 1724 wrote to memory of 952	1724	ocobg.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\ocobg.exe
  "C:\Users\Admin\AppData\Local\Temp\ocobg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\bebuj.exe
    "C:\Users\Admin\AppData\Local\Temp\bebuj.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 216
      4⤵
      Program crash
      PID:3772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 256
      4⤵
      Program crash
      PID:2100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 952 -ip 952
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 952 -ip 952
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 420B
SHA256 f3e63fc449c78fcafd8751be82cfefcac65d678e8cb9aea1d28f68707aecdf69
MD5 205cb699ef7365b13d9efe2b657da69d
SHA1 59523df0e4c8abef9a381c2a13909f7ef08fc92c
SHA512 b4c5438d9ae07d15725451b40f8c54e485c3d0f189d2ea26e879f4d6994146a093c8a388791807a1a33da9d2766d7ea3bd420e1117b704cc764ddb0a24e8170d
TLSH
T126E0E502449FCB1B020CE41B02A4794EC17549B43F8627E56F11C58C61DEC2AF0A3942
MD5 SHA1 SHA512 TLSH

Submit Download

bebuj.exe

Path C:\Users\Admin\AppData\Local\Temp\bebuj.exe
Size 220KB
SHA256 5cc95ed10faf1a25a93a481349050990d2b3a024d67586eb414654eea7758953
MD5 18fcadbab55b1dc3d14db117af35f90b
SHA1 9d596eb30aa44c23f133a0a77e8f8f6b4b6e8c07
SHA512 f50ddfea6adc07f4ca088d5be03428fe63a85df8e36dd24a5e0b507b9ed68a3e290792f872fbcb3e9f5b76afbe4b26252803e59a05716e17cc8dfb2f2837fb3f
SSDEEP 6144:UABALYsjkiD6extqRySu3NDBv46Jw9r7cp8:UABAkYYerqR0NZnJs7z
TLSH
T10424D052670048A9F36D4B325D46F5E849559E3C68C8F24FF03CBE36A8322939A7764F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1cf8b595c72049c44e08e80401c264c5031709397c86e305fd572d232939e172
MD5 3709718cd63a41dd06fbf61a1be84f75
SHA1 991c84b4a54c455172ee179d6532a698146e528f
SHA512 9b7097577e1ba8e7d85bbd90be567b3f01379e4fb8e2d986d08923920029269508d85dd63b0cac15d3c50f0b92019d1df94d31b6e1259738661f8e32989ad328
TLSH
T1DDF04CEA2065A0653716EA11D698175457935D8C2A475C6C1545B2308D76C1C4904259
MD5 SHA1 SHA512 TLSH

Submit Download

ocobg.exe

Path C:\Users\Admin\AppData\Local\Temp\ocobg.exe
Size 621KB
SHA256 9d7ea55c7090663a9ea130e5b7022299e2ae976d8fd125c82f8552d9287c1054
MD5 991fbb5ebc61385d9e00acd103a03d0f
SHA1 10bead34555c205c5c2b4222cea728eb56f6e0a2
SHA512 4540418883d46bcd25d8c7b3e97d1d39560733efff684d7ec7b667f3c6fcf64753ec6980d74885a1c05c20a3355c1c371f2e71362f9f2bd6c3bca2cc2c775a23
SSDEEP 6144:Mo3wRi+1Py3V0a2WkzSnwR4t2vJrYzfBmpho67hLF7ms2YJz7EZZlznhG6Jp2B8:/af1PyKa2JRs2UsJ7is2YJz47lzhG6X
TLSH
T1E2D4AE2172808035F76A0B3059A5E6E4086CBD3917A4E58FF7787E3A29B01D35A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-28-0x0000000000C90000-0x0000000000D31000-memory.dmp

Download

memory/952-30-0x0000000000C90000-0x0000000000D31000-memory.dmp

Download

memory/1080-16-0x0000000000FA0000-0x000000000103C000-memory.dmp

Download

memory/1080-0-0x0000000000FA0000-0x000000000103C000-memory.dmp

Download

memory/1080-1-0x0000000000FBA000-0x0000000000FBB000-memory.dmp

Download

memory/1724-13-0x000000000084A000-0x000000000084B000-memory.dmp

Download

memory/1724-12-0x0000000000830000-0x00000000008CC000-memory.dmp

Download

memory/1724-19-0x0000000000830000-0x00000000008CC000-memory.dmp

Download

memory/1724-29-0x0000000000830000-0x00000000008CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads