urelas | 496452454ad032e410e742a6f6870d9441a266b169812be8cbf517b5160391a5

Analysis

max time kernel
150s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 399KB
Sample261007-wp32ssdx6m
SHA256 496452454ad032e410e742a6f6870d9441a266b169812be8cbf517b5160391a5
MD5 e87afbde636ac0208302c8ab3d412522
SHA1 9794fae4ac1d0c75e413d459e14e1edd1e15d2af
SHA512 1b803d813c935b1e8ef027f5f0f1139a4829b5c8af967c52bcc9ee51fae8e57280873f825400b7379cf40ebf7333c2dc3e4c1a5b3dfdb23a0306eba906bd76af
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBY:yIfBoDWoyFboU6hAJQnrY
TLSH
T1E694BD253140C436F32A0B354456EAB14AA9BC3A15D9E48FF778BE7A5D311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
2432	guhyv.exe
2688	worumu.exe
800	kupew.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6088	cmd.exe
5880	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	worumu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	worumu.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guhyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	worumu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kupew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe
800	kupew.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2432	4664	2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4664 wrote to memory of 6088	4664	2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 2432 wrote to memory of 2688	2432	guhyv.exe	93
PID 2688 wrote to memory of 800	2688	worumu.exe	94
PID 2688 wrote to memory of 5880	2688	worumu.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_e87afbde636ac0208302c8ab3d412522_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\guhyv.exe
  "C:\Users\Admin\AppData\Local\Temp\guhyv.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\worumu.exe
    "C:\Users\Admin\AppData\Local\Temp\worumu.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\kupew.exe
      "C:\Users\Admin\AppData\Local\Temp\kupew.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 be61563bd90888d1508de0d0f7f52fe6cf8a9f518f0e0fd272b3734bc51f70c6
MD5 b822d38915804eeedf3668115127ee09
SHA1 7e791701cfbf31f1ef4fc23717575bbcd5a84735
SHA512 2340ca35b3d73c4b9f759045b43c896ad0915eb258d8e2a0ef334d2b7c20828cf7e7900b814e1ff0e437108c8a8c68e65e418b7468e32782137c0c279adcd3d7
TLSH
T110E02B09409FDD7B040DC10B01FCA59DE2A05A58BEC737B83A10CB4C61E995EB8A2601
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 50da8b60b2cbdec358c80a27943645b195f413bb5f0d37e1f6c3b60ebd3104ae
MD5 a583c300b26c38780315e83ade0af831
SHA1 0f9df7ecaaf4a670b25b72537b93afc6a23cbde1
SHA512 16a0c41539c18bb3547aabc269d9364e8f5b5e9561c784d23435d3f9e0d7580611b1d59faf9ac3be1ad3b96b1df1fe74ebc742b80c4615085484e10b2c361355
TLSH
T170D0C71281D7D76F0448902B06B5A38DC0755C5C3F577B11D721C44C61C541DF9D7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 246f7cd4aaecf080235f7dcbf8c0734aeab599e0d26281da1eedbe2f578ce3c2
MD5 ba9c5d14c2b2dfdacdad801108f87823
SHA1 63132e6d9ce9540cf66fe831b423d4899e562895
SHA512 31fbdc25856b88ee92bc48c1d3ae9eb68f3dbe6e8400cde1b8bf8ddbc0da92f51f559ca546408a6c902af2eaadb5942c8060031292d1380d9d62ba23ab6f445c
TLSH
T19AF04CD22451A1893611BA12E69407D527931E8C2B87CD940649B2708B7795C8444265
MD5 SHA1 SHA512 TLSH

Submit Download

guhyv.exe

Path C:\Users\Admin\AppData\Local\Temp\guhyv.exe
Size 399KB
SHA256 386dcfb8457b9e7e97a1d8ada33ed007869a45ded01211fa5cac182685d141af
MD5 5d788f06c587cb45672c6ed996444134
SHA1 a40b5764d26e5eb378a67d95694b35591e345bb8
SHA512 fece5aad9445801e73e3a741ef56e367b4b0e02592d68faa22ab4fa33efde8e760e575118110ceb9701444f4a8769dfe232e199e30cb38500fd4d5c9fb7deafd
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBq:yIfBoDWoyFboU6hAJQnrq
TLSH
T17A94BD253140C436F32A0B354456EAB14AA9BC3A15D9E48FF778BE7A5D311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kupew.exe

Path C:\Users\Admin\AppData\Local\Temp\kupew.exe
Size 223KB
SHA256 b269d20dbbd0d92f148d9ce98ff465084e9ae5589af090cb5a7bfabff7842fea
MD5 da1904ca002691808cd1232fe9878e52
SHA1 5ceeebe57434801b0b1be3e652a53430352abe15
SHA512 4331a247946acd41b082eb0d78652cab28811b749e98b71bb6e3dd71226d3ef5bdc2a6595c5dc2e15f8964f58e21a3f1cd677d49a3d5ee4b57f50d8bfc5034f5
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3L:unFhSIkAyDgjtS/FZF
TLSH
T1B524E042AA018888F34C4B316A17FAE449858D3C59D1F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

worumu.exe

Path C:\Users\Admin\AppData\Local\Temp\worumu.exe
Size 399KB
SHA256 12888d12ad1197dbf1729423814e840df0c80d01772245b9d7c13cb24682180d
MD5 d40be9ef80e26f66446eda7b7fc5f3bb
SHA1 f622d1eba2d1675b95a86535cd07fa723697eae1
SHA512 33002c6ae820f52de3138bd80fa676e264a1d6e93480317d53447ef92608020178d0330fc85f399329387413aad4cc19545c0392d2a6f5d8a9b09eca07aa9323
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBA:yIfBoDWoyFboU6hAJQnrA
TLSH
T1A794BD253140C436F32A0B354456EAB14AA9BC3A15D9E48FF778BE7A5D311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-45-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/800-59-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/800-58-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/800-57-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/800-56-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/800-55-0x0000000000420000-0x00000000004C0000-memory.dmp

Download

memory/2432-22-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2432-31-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2688-34-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2688-52-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2688-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4664-21-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4664-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4664-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download