urelas | 78884f0e6287867e8e2a6cf4c47a5bbf59eec0c9f26a996d244ef91451cd4c65

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Plite.bhty.exe
Size 392KB
Sample261012-3zycmattcy
SHA256 78884f0e6287867e8e2a6cf4c47a5bbf59eec0c9f26a996d244ef91451cd4c65
MD5 a8c2c05fb9ed9878c6a262ddf8bf250c
SHA1 a60bc622a16e68317be0b6760a47aa709498194d
SHA512 940fbb64d7e7669303fcd9cc4c5840c8a3dcae438de0e4a8b2131212683074e152b23a7adec93ceac6ad362de58604873fda53d8999085a894d5391d6ea55565
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohtc:8IfBoDWoyFblU6hAJQnOE
TLSH
T11284AD253140C436F3290B354455EAE119A9BC3915D9E48FF778BE7AAE311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4220	coidf.exe
4640	xegoxi.exe
5156	zacik.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5168	cmd.exe
5328	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xegoxi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xegoxi.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Plite.bhty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coidf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xegoxi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zacik.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe
5156	zacik.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 4220	5384	jaffacakes118_Backdoor.Win32.Plite.bhty.exe	90
PID 5384 wrote to memory of 5168	5384	jaffacakes118_Backdoor.Win32.Plite.bhty.exe	91
PID 4220 wrote to memory of 4640	4220	coidf.exe	93
PID 4640 wrote to memory of 5156	4640	xegoxi.exe	95
PID 4640 wrote to memory of 5328	4640	xegoxi.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Plite.bhty.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Plite.bhty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Users\Admin\AppData\Local\Temp\coidf.exe
  "C:\Users\Admin\AppData\Local\Temp\coidf.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Local\Temp\xegoxi.exe
    "C:\Users\Admin\AppData\Local\Temp\xegoxi.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\zacik.exe
      "C:\Users\Admin\AppData\Local\Temp\zacik.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 290B
SHA256 989962dcc877ef91ab4103018c32db5e86a2a37ff17438c1515308b3ddc1a9c0
MD5 6eba4da1963e1add50e54a26fa0d852f
SHA1 1a4da25c389916af29b260f0c1d99bbc6ce5f61f
SHA512 98d2c8c484fa19b166fac2eaf4e52f25fb4b8de20275fe2085d9d2ac2a6dec18645f37ce530bca47bcda3a6bfc6052d4512d2e45c3a3a515553d5cb04c83fb4a
TLSH
T1A1D012458197DA5E080CE85B457192CEE0644C5C7F9A3F04A732D5DC22E281EF6C3745
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 e144709fca3bd216abc8c1efb099b69cca35efee6f7c21ba58612f87a9e01739
MD5 bffdc3c62b98263e3a93d51762d3ee6b
SHA1 b7138f70fac20d0ec37730a7d288fcb6c682bb69
SHA512 726bf912cf116b08b9ad418abe662aeacea2088ee955e0b7ae87981379efeb556dc98b6cf86e1b4c9c6d67592c5a50588cd2e39d8a7355855c34fa3aa39846b8
TLSH
T131D0C71241DAD79E0C48A02B06F566CDC1754C5C7F4B7F119721C84C21C241DF5C7741
MD5 SHA1 SHA512 TLSH

Submit Download

coidf.exe

Path C:\Users\Admin\AppData\Local\Temp\coidf.exe
Size 392KB
SHA256 d710e0a06e697111a71677caea2a52d21d75149e785d1650ae9200675d1e0645
MD5 b5be017ad0b525091689af62ff403e77
SHA1 8828cc5f8ddf37b0c9e5c6daaeeb2425855e78b0
SHA512 311a1dd22a44d26ce6926d3d5d95aa0eeb1bcd80ef88158ec286019b14990cbf7da7fa281f9d2ae8728f75f0af386bca8d124f0a1b151f659504fa0229b1574f
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohtf:8IfBoDWoyFblU6hAJQnOn
TLSH
T19F84AD253140C436F3290B354455EAE119A9BC3915D9E48FF778BE7AAE311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 41975dda31e353127dc7bc05d424c24604099efb5a79a881e64275b79b618d35
MD5 239516f7ce2df26c774e90f6e9aa3611
SHA1 8ebef96a175af1d2367638cc58357828520d6356
SHA512 de56aefd10bcfc0b2146b5eacb2ad2d940a4f72ae499725b7e5f3614034d27c41df88339c5e202d100b837c471465eed0c6267f792487f2cc54fcb4ca534f347
TLSH
T15EF09BDD2066B1553512E733C7F447F717835DCC1DC7DC980A1575344D75D5C8444255
MD5 SHA1 SHA512 TLSH

Submit Download

xegoxi.exe

Path C:\Users\Admin\AppData\Local\Temp\xegoxi.exe
Size 392KB
SHA256 088dc4575bdabdba301299b6aa686260e6dfae05fd95c024264926d8980c0ef8
MD5 76bd05e09d26b846b091ec758702b54b
SHA1 8a866079d721f1f274f9cb2fcf0aef804e0af009
SHA512 81a47f3c03b06bfc4fccb3a91374359746aa75a40be57058b302cc50d2e273a9ca9bead0bf44dd0883d62080391a3b216be310236af13387233d3dad193103bd
SSDEEP 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohtZ:8IfBoDWoyFblU6hAJQnOh
TLSH
T16084AD253140C436F3290B354455EAE119A9BC3915D9E48FFB78BE7AAE311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zacik.exe

Path C:\Users\Admin\AppData\Local\Temp\zacik.exe
Size 223KB
SHA256 0ddfcf47d2812d9e654290de03ed139f85b81bb6c51746fa84e582448a6d1a64
MD5 6625a90c3303e27db7af2b7b904454ac
SHA1 0ec08c8d7c4c9e14f65f51cc88eb205aa5668c61
SHA512 ae008bf814fb8fe8802e0c28c1558728556fd0f80779c3ecaacbbae6943cfa54f014a39a9c8dab84c7dde0dc3d13e18e5447b04cf7c514eddb2506c48399ee92
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p31:unFhSIkAyDgjtS/FZ7
TLSH
T13A24E041AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4220-32-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4220-14-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4640-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4640-33-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4640-52-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5156-44-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5156-55-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5156-56-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5156-57-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5156-58-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5156-59-0x0000000000AC0000-0x0000000000B60000-memory.dmp

Download

memory/5384-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5384-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/5384-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download