urelas | 27e160a3cf0d0648acec630e12524cd4d88c70d32c60cefb764a5665a0f320f8

Analysis

max time kernel
149s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample261019-lagj5sfb49
SHA256 27e160a3cf0d0648acec630e12524cd4d88c70d32c60cefb764a5665a0f320f8
MD5 2089e738bb5e15ccd521f2a42d6bb652
SHA1 9747e64f47f0ec0d36f7a6a6c278344517a81727
SHA512 7e1a2339593ed42b6762ad291a8195ed040dc3d9192429a2d7efd259a12dcc22bdcc95e14ace1535af0725f6fe4733b310629f7aa2d83adae1bff7cd3bed9582
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMO:AIfjoga6u1AVDO
TLSH
T15365D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
6056	poleo.exe
440	urxoig.exe
1148	ydxax.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
268	cmd.exe
2140	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	urxoig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	urxoig.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poleo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urxoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ydxax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe
1148	ydxax.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 6056	5104	2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5104 wrote to memory of 268	5104	2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 6056 wrote to memory of 440	6056	poleo.exe	92
PID 440 wrote to memory of 1148	440	urxoig.exe	93
PID 440 wrote to memory of 2140	440	urxoig.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_2089e738bb5e15ccd521f2a42d6bb652_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\poleo.exe
  "C:\Users\Admin\AppData\Local\Temp\poleo.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Users\Admin\AppData\Local\Temp\urxoig.exe
    "C:\Users\Admin\AppData\Local\Temp\urxoig.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\ydxax.exe
      "C:\Users\Admin\AppData\Local\Temp\ydxax.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 444B
SHA256 f6b307dc8a4f7658a91701d2ff33ea18c73302ea0fd0580d3f6612ea0c010889
MD5 abd66239a3befb99a16001ba27880fac
SHA1 d4fa009defa5b5e29f1800d2266ec7f73aaff69a
SHA512 9f667d8e780d4d72621ceb39adf8804961a6aad93e688bdf794e51b5afe3f49a20da9e888fbb1b48c2a8eb645cda3586eb0be1dbc61a16a0d399cfdcff075fd2
TLSH
T10CF0A701005BCD76041DD04B05A9A55E81F5869AAECA3B713230C75E72ED84EB492242
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 8e91cf101b90513e86fc79a618d56f7276e666322f499801499f838b5af2bd38
MD5 8aeaef7f2ba8fccb731b704a047e3fa1
SHA1 31cf5bde94def6a405226b3c20dbcc78bdc25e30
SHA512 1c2fd7b0808cb8555ba2bb59788fada40aab9ded38a7d4257b3432762cb876020b1c873c191777340887ec5f8a8df0ff8f10e9fb9e65bb244465102816dabcac
TLSH
T111D0C75146D6D75F044C902B06B5628DC0754C5C3F473B51973AC44C22C181DF9D7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 264906aaef8932d1fc4f7a906bb6f8af00428cd6e4cee1efee549496e1791fbe
MD5 4cba918990224c78b6ee7f1e0cbb4f70
SHA1 5b04426fae9af64948d928c742de01a6a10c40aa
SHA512 ad2705d73d311816e32cdf485f0a3711e3469efba5ee7a51ffbf37422eb4d5f9d27ab5756c29fb7528b9390c0b1a0f8af72add96c41edbf54acfa3871b1b6c91
TLSH
T191F09BD71051B8853751E313C39417D56B931DCC2E479E84059576708977D4C4454265
MD5 SHA1 SHA512 TLSH

Submit Download

poleo.exe

Path C:\Users\Admin\AppData\Local\Temp\poleo.exe
Size 1.4MB
SHA256 73a7e36002a9298da7ee38d0f33bb2d8c33ae902aa413e1e6547389bfb15d564
MD5 1e0ae44c76bfc302b11409e7e034efe8
SHA1 09e725c8da0ab81f2ebf59927e53a1660a545699
SHA512 f7b323ef2e06e6b4f529b40a46e93fe4dd9afbf7ca6b2dacb46ca31cda0f13824773c9d31b8bac4a1ae202e8cde76984f8d6839c3faa09011283f292d32a684d
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DMd:AIfjoga6u1AVDd
TLSH
T15B65D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urxoig.exe

Path C:\Users\Admin\AppData\Local\Temp\urxoig.exe
Size 1.4MB
SHA256 799ed931ffc0e5eae250ae91554d20efedef61baae9bc8fa6228515652c76279
MD5 bb92f6655c49f2375efc67d1ac440d02
SHA1 f1a24d4e7daadb8447ec7fb3472ffa1f0339a486
SHA512 3a43f520b744ee58d3a0244274393be9cd6f9615009cb5f64a58e0d214deb5b4f70cb32d3a95ec3c831e7d8b22af1c34ea99a9cefb594700316a5953d591b218
SSDEEP 12288:AIfBoDWoyFblU6hAJQnOzer5+nZoWL1rA1YaL8i0DM4:AIfjoga6u1AVD4
TLSH
T1A865D557EB814AE8E75D09365B588150D62EFE215A4F2350B46C721CCFA338B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ydxax.exe

Path C:\Users\Admin\AppData\Local\Temp\ydxax.exe
Size 223KB
SHA256 1951d95dc53974dc5ab57586e20068c0bdd2b4d0c0496f94a9ab88b4c0a49086
MD5 e297554fbb6b5a58e5a4fc104652f9b4
SHA1 7acf4c15dafc1c86bcca3abec03b886880489443
SHA512 74e117e821be95fcb7ef49b018c37751c47422873d7f77453ad4e8b640939b8dde5d92ad11f9514d1fb0c72b654bbd0a227724f34a63876c29cdb1a506e56ec0
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3j:unFhSIkAyDgjtS/FZt
TLSH
T11E24E042AA018888F34C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-57-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/440-36-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/440-56-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/440-37-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/440-35-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/1148-59-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/1148-47-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/1148-60-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/1148-61-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/1148-62-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/1148-63-0x0000000000E10000-0x0000000000EB0000-memory.dmp

Download

memory/5104-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5104-0-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/5104-23-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/6056-33-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/6056-34-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/6056-13-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/6056-16-0x0000000000400000-0x0000000000570000-memory.dmp

Download