urelas | 699b308e427d30d3c841b312629392fa59aa577d25d1abc0a3323645c9a7481a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe
Size 586KB
Sample261023-rbbceaet5k
SHA256 699b308e427d30d3c841b312629392fa59aa577d25d1abc0a3323645c9a7481a
MD5 2ae2725201965399573c83e4885a582c
SHA1 8b07aabfcd9bc0bb4a2a68fbb427889958b2d074
SHA512 0b87bc98c92692f7e34eef4b08483fca35f2f62bfe5921bdbcc0a6f70edf43bdf6a8d17f9d9a52602d01480971941b77fcdab073ab6ef1b615a17de84610876f
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgts:SnPfQpziAkI09HLMgS
TLSH
T161D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3448	wocev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wocev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3448	4640	2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe	89
PID 4640 wrote to memory of 896	4640	2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_2ae2725201965399573c83e4885a582c_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\wocev.exe
  "C:\Users\Admin\AppData\Local\Temp\wocev.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 339fcc954f5be82181ec34f79657b2c7cf0250cc967bd6cbc12ffa0db7446789
MD5 bae41c39372666ec85ca954509866afe
SHA1 2f310ff7424b06f3ca91ddb56e27fc9f4d224853
SHA512 d05337e46deaa956e3c0ba1e854b35e6f12d148fd82cf55ca254bd398ae7082b62dea0d6f22b5a531616cf1a14e52ef0613716f403257bfa28e64444c1cb7bea
TLSH
T187E0DF4201ABEE6E0508A01F0FE5A94DC0B469587E8B3B207B11C26C91D101DB4EA202
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5cab4477630a489657c0171a7604e229677bc6baa4c6bda008ccc156b689603a
MD5 745c80bf90a8020b00b23a6259d91495
SHA1 8b91db01ddfe015cbc74bcb14f20eb2e63ea9729
SHA512 163e6bc7144933ba36a1810c0042d59c000b11fb3ae3f0b870c2f4b2faf84a548c7041a7482e564ab48043559afb3bad40cbdbbc07d528d7076d98e2e5c774a5
TLSH
T1EEF04CD62065B04A7112E633D7940FEA2B8B5E5C1583CD544515B571983486C8498276
MD5 SHA1 SHA512 TLSH

Submit Download

wocev.exe

Path C:\Users\Admin\AppData\Local\Temp\wocev.exe
Size 586KB
SHA256 88f05dc652d686f4ac206950f1390c0ee8300c50cf402a2a82256519d09b7f78
MD5 e85d982bd5233a9de69d93ca005329d7
SHA1 c10f679e32541cc9c287e58049c9e77d4b9255ad
SHA512 f9fd803a0e57a0cfac3b89892ea45cb4b254cdf7f347813949e81471e478df748b75f7cd17e4ced9431555ed49abc7966e47234163c99eac1378f3f920f23f7f
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtL:SnPfQpziAkI09HLMgV
TLSH
T1F8D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-12-0x0000000000050000-0x000000000011F000-memory.dmp

Download

memory/3448-21-0x0000000000079000-0x000000000007A000-memory.dmp

Download

memory/3448-24-0x0000000000050000-0x000000000011F000-memory.dmp

Download

memory/4640-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/4640-1-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/4640-20-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads