urelas | 07aaa5b40fe580f47c330b6b3731f52ceb93c435f570ce0d78da5551b92bb1c4

Analysis

max time kernel
148s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 621KB
Sample261006-3mlhashv2x
SHA256 07aaa5b40fe580f47c330b6b3731f52ceb93c435f570ce0d78da5551b92bb1c4
MD5 5d8d2b5d3d20dbe881718e55b25839a2
SHA1 a4a953fe85a0f08c8dae2ef5d8a71f1cb8486a3f
SHA512 60dae576db9a7932e9941cbbb78b16c4499f90ab24c250671dbb88a0b6adaa9f1c2f7861c9cb943d6b6bca321e13187c3f4ab050bdf91bd7c8d0544f45daf516
SSDEEP 6144:Mo3wRi+1Py3V0a2WkzSnwR4t2vJrYzfBmpho67hLF7ms2YJz7EZZlznhG6Jp2Bz:/af1PyKa2JRs2UsJ7is2YJz47lzhG6A
TLSH
T14CD4AE2172808035F76A0B3059A5E6E4086CBD3917A4E58FF7787E3A29B01D35A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4816	uwzik.exe
2328	lusaj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
832	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4376	2328	WerFault.exe	92
4800	2328	WerFault.exe	92

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	uwzik.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	uwzik.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lusaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uwzik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4816	4456	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe	89
PID 4456 wrote to memory of 832	4456	2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe	90
PID 4816 wrote to memory of 2328	4816	uwzik.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_5d8d2b5d3d20dbe881718e55b25839a2_amadey_elex_karagany_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\uwzik.exe
  "C:\Users\Admin\AppData\Local\Temp\uwzik.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\lusaj.exe
    "C:\Users\Admin\AppData\Local\Temp\lusaj.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 256
      4⤵
      Program crash
      PID:4376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 264
      4⤵
      Program crash
      PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2328 -ip 2328
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2328 -ip 2328
1⤵
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 420B
SHA256 f3e63fc449c78fcafd8751be82cfefcac65d678e8cb9aea1d28f68707aecdf69
MD5 205cb699ef7365b13d9efe2b657da69d
SHA1 59523df0e4c8abef9a381c2a13909f7ef08fc92c
SHA512 b4c5438d9ae07d15725451b40f8c54e485c3d0f189d2ea26e879f4d6994146a093c8a388791807a1a33da9d2766d7ea3bd420e1117b704cc764ddb0a24e8170d
TLSH
T126E0E502449FCB1B020CE41B02A4794EC17549B43F8627E56F11C58C61DEC2AF0A3942
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f97fa5f889d2edf5445ece84ad352db6107130d2b56162e6a7ae845fabdf0a8b
MD5 6232adbca4ad709797e3a2b95a5024c0
SHA1 6358df026b8eb633195c162520323b8978860c38
SHA512 491277329d4a55145a02ada73e4d15c1a06f61bd53efa5c559376130e60d7e03812e2a5cf5a4477c00643f30655a649ec127692446d27635c3eb062128441810
TLSH
T10DF09BD92071B0497725E213D3950FDC17935D985A87DC94421575345D75C7C4494357
MD5 SHA1 SHA512 TLSH

Submit Download

lusaj.exe

Path C:\Users\Admin\AppData\Local\Temp\lusaj.exe
Size 220KB
SHA256 4fa5ca15f07475b1fe691a91778aba16c27811d4a9f51e4a21f93bd8cfb76973
MD5 f0eafe8ed60c096920bbb103de056f12
SHA1 6cf308f9f8a99abb49c18b7867d776c3a3090bc6
SHA512 6139bde40bf242645230b5ff50522f618c6beda8172355113890d45f2e45281fbbf865f4f1b844d1ff612310a227765590168a0ec82783893fb43abeba4ef822
SSDEEP 6144:UABALYsjkiD6extqRySu3NDBv46Jw9r7cpy:UABAkYYerqR0NZnJs7F
TLSH
T17424D052670048A9F36D4B325D46F5E849559E3C68C8F24FF03CBE36A8322939A7764F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwzik.exe

Path C:\Users\Admin\AppData\Local\Temp\uwzik.exe
Size 621KB
SHA256 c99e99b188ff3ee90c8735f177edaa46caffbef77e9e1d1064fb67aa5dc974fd
MD5 ff347b3dd9bc8b9f633360084bcedcc4
SHA1 fe0025ad74cb6abdf161425ac90e0b3d12800bda
SHA512 790ebe90ee820078490e6ec068979386e7781183ecdb6ceae705215ee6cffc84b0a760c16e9ac5f7d547dc9eb46d8dc282cf28ed09b55464c7812737fad23dcc
SSDEEP 6144:Mo3wRi+1Py3V0a2WkzSnwR4t2vJrYzfBmpho67hLF7ms2YJz7EZZlznhG6Jp2BT:/af1PyKa2JRs2UsJ7is2YJz47lzhG64
TLSH
T1A5D4AE2172808035F76A0B3059A5E6E4086CBD3917A4E58FF7787E3A29B01D35A7739F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2328-36-0x0000000000890000-0x0000000000931000-memory.dmp

Download

memory/2328-33-0x0000000000890000-0x0000000000931000-memory.dmp

Download

memory/4456-1-0x0000000000E5A000-0x0000000000E5B000-memory.dmp

Download

memory/4456-0-0x0000000000E40000-0x0000000000EDC000-memory.dmp

Download

memory/4456-20-0x0000000000E40000-0x0000000000EDC000-memory.dmp

Download

memory/4816-12-0x00000000009E0000-0x0000000000A7C000-memory.dmp

Download

memory/4816-24-0x00000000009E0000-0x0000000000A7C000-memory.dmp

Download

memory/4816-35-0x00000000009E0000-0x0000000000A7C000-memory.dmp

Download

memory/4816-21-0x00000000009FA000-0x00000000009FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads