urelas | 88c6f879902165896f90cd0bbd28a7b117a1accf5a39220c00eefeb41924fc58

Analysis

max time kernel
150s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 431KB
Sample261020-mlwzmsgv6z
SHA256 88c6f879902165896f90cd0bbd28a7b117a1accf5a39220c00eefeb41924fc58
MD5 b56c84e26e6ba4895ff882349529451b
SHA1 c16386c3a54fad5ae63bfc29ff4307c8891612c2
SHA512 d0cd958be290ae6fd6612c865479309607eeb6877fd28d59ca5042c68f9662f161033cbc0fe05daf668b4507b772d2535343b4c731afd66429128915487df2e8
SSDEEP 6144:iEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpk:iMpASIcWYx2U6hAJQn7
TLSH
T18C94BD147640D472E31A0B311416EAE059A9AC3A17D9E48FF3387E7A6E311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3344	jotua.exe
4396	heafuq.exe
2568	vuizc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
3496	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	heafuq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	heafuq.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heafuq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vuizc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jotua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe
2568	vuizc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3344	1216	2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 1216 wrote to memory of 4312	1216	2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 3344 wrote to memory of 4396	3344	jotua.exe	92
PID 4396 wrote to memory of 2568	4396	heafuq.exe	93
PID 4396 wrote to memory of 3496	4396	heafuq.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_b56c84e26e6ba4895ff882349529451b_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\jotua.exe
  "C:\Users\Admin\AppData\Local\Temp\jotua.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\heafuq.exe
    "C:\Users\Admin\AppData\Local\Temp\heafuq.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\vuizc.exe
      "C:\Users\Admin\AppData\Local\Temp\vuizc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 0db7dc32e2d8040d42a5a67ae82f3fd2716463a10b1c9c5cdb06f025241ed921
MD5 3f3d7499b793529e56e79cb1cc5bdc5f
SHA1 bbf2280d53bbc5ef6ccd598892ec0ac22a6129d8
SHA512 0836f29d932443cd1f4e814df3de1d2d713d253e0dfb0cd0cfe62ba1b20e9c54ce79b30335c29ae45ac7f2ce73288360b44ed47c0991a3396c155788b8231d79
TLSH
T16BE09B42019FE93B014CD05F62BEA58D81654B653FC73BB87610C74D61D684DB4B3281
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 3249349f7cdbec1ee897175faff71415972c25b70881fe3e408fa79238aa8fba
MD5 5c2c284760cdeb301e3af1ed338b3023
SHA1 6654bdc748be4dee26c7f0747932f147e3150ea5
SHA512 d4a73f8d3489e19862cce2a5272587cca60c0f0b0d810211a99a2a3479b1e0ad0efcc0840000c8c6ebb9f3491c50389a54ccaea4fb7f94612b8646295ea45b3f
TLSH
T1B8D0C75141D6DB5E0448D06B4AF5A18DC0754C9C3F473F11D721C45C21C541EF9C7741
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 a3114c2e1df2dc92c560f1a2a504bf438718a9b6fe72c69fa623864844a51317
MD5 d51770b823418022e3ef5bef2885e1eb
SHA1 7a7fb8a7d217cae812fb43bfd33681431ab4bfdf
SHA512 88934cc65e4184921d011edc2cb2b90ce1fc8b3de283e7b28f3e21e67e3d1fb2f9e5d9e879a8a9e6ef9ae62614734a328a7e210e4f29cc5975278e990561fa87
TLSH
T11AF088C228A0F0023A22AA23C3882BE033832CA80A83CE800008B222883082CC088282
MD5 SHA1 SHA512 TLSH

Submit Download

heafuq.exe

Path C:\Users\Admin\AppData\Local\Temp\heafuq.exe
Size 431KB
SHA256 afda18ee44fd52aad590f558391bbbf3d8daca3a6df8923d7e1243e10d249548
MD5 02bb803ae97570ed6a599aa5b1926c9a
SHA1 4934cc9a3b6f785d2afc52e8c9dd3ded8ddfdddc
SHA512 9abb83e1a94c9f9bdc2de8e6be023ac9690c6b1e41e866c24d517e188fd5faba338d5f078bdbb6863b8d135bea5c8e04cb2f0c8e3185da14dd16fb253477e952
SSDEEP 6144:iEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpF:iMpASIcWYx2U6hAJQna
TLSH
T12694BD147640D472E31A0B311416EAE059A9AC3A17D9E48FF3387E7A6E311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jotua.exe

Path C:\Users\Admin\AppData\Local\Temp\jotua.exe
Size 431KB
SHA256 1c1303740f1016f5800142f4201850f22d9c19b56443b32c1e5ba8ef074e51bd
MD5 571f0ee2750a74c252efcc98ce6f4ba4
SHA1 29e01adb7addf06052fa43e8ff30fc618f32e866
SHA512 6774416b8b8c88c2078603cec930196566f1a85380ec3cadd29906beb1b4559f2dad9ed35213809abd53be9ae47a586ca45bd2ca9ebd3f4a2bb876bd367021b6
SSDEEP 6144:iEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpg:iMpASIcWYx2U6hAJQnb
TLSH
T13194BD147640D472E31A0B311416EAE059A9AC3A17D9E48FF3387E7A6E311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vuizc.exe

Path C:\Users\Admin\AppData\Local\Temp\vuizc.exe
Size 223KB
SHA256 fbb82f3c551b5d45dcd3dbad6ba95cd39c58af3024fb688098a9fee509a456a5
MD5 dc58c6ebdf65e62807bde1083d9a55dc
SHA1 575134bcc3bbd6230a2f4fe732ce7e65effd1e86
SHA512 0b0a9e9ee885839100f3a07f1653cad2a25882b295b548327ca1352899499d3415ff4ed380bd534372ab5ce56e295bda1bcf1ce3c61a8263a9e03a8a65d8c814
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p30:unFhSIkAyDgjtS/FZK
TLSH
T1E924E042AA018888F38C4B316A17FAE449858D3C59D5F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/1216-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1216-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2568-55-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/2568-44-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/2568-56-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/2568-57-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/2568-58-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/2568-59-0x00000000006C0000-0x0000000000760000-memory.dmp

Download

memory/3344-31-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3344-18-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4396-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4396-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4396-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download