urelas | f5af8a44cb8870ca5bbae5b38271b40fa8d495ab1feb64be34bafd2cccfd411d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe
Size 586KB
Sample261023-kfbemscy7j
SHA256 f5af8a44cb8870ca5bbae5b38271b40fa8d495ab1feb64be34bafd2cccfd411d
MD5 afe1904f64d45587258969c4a465eee1
SHA1 7b60de9244a4fe357334cba0febb624f16dcf3ac
SHA512 9ada75b9f1f90beefe2980589a2c55af8ca28665c08b1802287d33c2ef97b0c733cf1f938fffb99494a56296fbf31717aa45e7d5589657f6f41c79df294762f8
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtz:SnPfQpziAkI09HLMg1
TLSH
T159D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4084	bepeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bepeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4084	4188	2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe	89
PID 4188 wrote to memory of 1944	4188	2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_afe1904f64d45587258969c4a465eee1_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\bepeb.exe
  "C:\Users\Admin\AppData\Local\Temp\bepeb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 f6ca28099578e90960cecff6ab19a3ec122cf03832aa092046e4e44febdd75bf
MD5 ee41f7a918b5c0d3221327489ec7e407
SHA1 7b0abb409f4336c5fd7fd0a99f266727379d0d8e
SHA512 e31b7f73108311eca4349a66510b29f47155d566ceeef84b848d9a9d8b2a1ab40128f0cd69481cfb86b90c7b8ea01d0caa38ee8dfb3172a4143356e01a160206
TLSH
T179E0DF0242AFDF2B4454A15B0AE5294E8074AA9C3F473B217231CBAC13C545EB5E7246
MD5 SHA1 SHA512 TLSH

Submit Download

bepeb.exe

Path C:\Users\Admin\AppData\Local\Temp\bepeb.exe
Size 586KB
SHA256 94ec7c5f82ee9a3529960aa27deef615dccf05bf0af9d4d36fcb485fab5df7dd
MD5 c0fc3337dda903b948f59bd6c998e9c4
SHA1 84324cb192e6967d4e96ab07b42ac41f5984257a
SHA512 fba500cf879acc65c9bb09a4178c2d5eee09751271988a13135ca29d06c455da0e06062802e1f8bc8521f24899072ac03adb577812208415162ba924f0e3b6d4
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtu:SnPfQpziAkI09HLMgk
TLSH
T108D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 4a8a71805822c203c7c053810eaaa71ddf898e08172685c65cd1a1216b39772f
MD5 bdf2c3f37c3110f0d135bc55d2ff9c95
SHA1 bfdca576416a7132e6b30412021de1fd0f4e4440
SHA512 8a4587499587c69268b4826e03c16a5b7480b3ccc977d19f203960ab342ee0e622bbc639ac4eaf69667abdecc66b7c1e7c1b5d68bb2ef455d4c9f3b27c854ceb
TLSH
T1AAF09BD75071B0577112D511F3B4275D33D34D8814436C544419F1714CB5C3CC558359
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4084-14-0x0000000000119000-0x000000000011A000-memory.dmp

Download

memory/4084-13-0x00000000000F0000-0x00000000001BF000-memory.dmp

Download

memory/4084-24-0x00000000000F0000-0x00000000001BF000-memory.dmp

Download

memory/4188-0-0x0000000000270000-0x000000000033F000-memory.dmp

Download

memory/4188-1-0x0000000000299000-0x000000000029A000-memory.dmp

Download

memory/4188-21-0x0000000000270000-0x000000000033F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads