urelas | 7edb9c79c4b72523928f54f0de96d42595b8ed92ac19c8c71e8ee556010f2a17

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe
Size 586KB
Sample261023-em671acb74
SHA256 7edb9c79c4b72523928f54f0de96d42595b8ed92ac19c8c71e8ee556010f2a17
MD5 eb77f191d120c3a5eaa8c9b3c61cfa63
SHA1 c093f89c0fe04ac01ee6778f288aa80622374f47
SHA512 365ff874952ffa4fc05dfe3ffc55da8596f4c625b9e4c463371449cf62fddcd2107eced195e474a1b7cd5e36e50da3ac7d40b125253092f50eac6c965b26a185
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgt9:SnPfQpziAkI09HLMgD
TLSH
T18CD4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4712	igzoz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igzoz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4712	1208	2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe	89
PID 1208 wrote to memory of 4468	1208	2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_eb77f191d120c3a5eaa8c9b3c61cfa63_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\igzoz.exe
  "C:\Users\Admin\AppData\Local\Temp\igzoz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 2b2662c55b0aa8b26d6eb10a2d27e9c7b3d9b86db8a6f32f8054be69ec9e0113
MD5 938ff5e8e71f30db4dc4bc2175bc00c0
SHA1 3bbd4322d19da5cfd05a61591b24e3ebc93dd5ba
SHA512 7f5663c2835025aa0f1fec13398df6ab7a8d295ffd2f4383684999b00cae99a85c008bc4a939011765f895a1d716b8832b04dcf09429c0ddf2afeaf431886076
TLSH
T13CE0D801416BDD7B104892270DE9664DC5B1955C3F833F31B614CB5D61E640DB5D6243
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d63ebd92f7d1329ef4b94fd1b6d9f10706abef691b3d6b0ad6ddb71bf83fe07a
MD5 cbd1208deca6eee294d7c61bc71a7988
SHA1 5b27ca1dadf4c3db9280067572f657ca7118f438
SHA512 14258ea78fb00c7f216c8e5bdef6836d57294eb06112535111104d556b9683acff4879af615d7f9623f29a434f5a08c4807e2bf21b4704d64c3365526aecb97a
TLSH
T139F09BE625E1B0993622B133C3945BDB13831D581643CC4840057371CD76CFC4598366
MD5 SHA1 SHA512 TLSH

Submit Download

igzoz.exe

Path C:\Users\Admin\AppData\Local\Temp\igzoz.exe
Size 586KB
SHA256 13ea01f778154e9858ad0f4fedfebe0108b8d24fad5c170e5418d2ff5db2e7fb
MD5 fdc2928878e842bebda18e57ea705dc9
SHA1 ea3d3b6fdc7589ecfb996fa9e2209223333e7d2f
SHA512 d8bf052ce7ed9946a00bcf2c5a9b75d36e08bc9fd51ed3edf9b57d153bc25d23ac8912829cbcda84744aa567609ecb14b95f330d8fcb4b4c5a3ec475cabd7be8
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtY:SnPfQpziAkI09HLMg6
TLSH
T18FD4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-0-0x0000000000870000-0x000000000093F000-memory.dmp

Download

memory/1208-1-0x0000000000899000-0x000000000089A000-memory.dmp

Download

memory/1208-21-0x0000000000870000-0x000000000093F000-memory.dmp

Download

memory/4712-14-0x0000000000A89000-0x0000000000A8A000-memory.dmp

Download

memory/4712-12-0x0000000000A60000-0x0000000000B2F000-memory.dmp

Download

memory/4712-24-0x0000000000A60000-0x0000000000B2F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads