urelas | 235271ab59eca5c84363f4c30756c1dc55e876de2ffbad8d30a2f42c7ac83dab

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 354KB
Sample261026-k2drwsag43
SHA256 235271ab59eca5c84363f4c30756c1dc55e876de2ffbad8d30a2f42c7ac83dab
MD5 e3cc4ce6e4c4bcdfda707a50ae58866e
SHA1 30d55b27cec3de9df19dcb601379b3254b1858d8
SHA512 b4872610b50d87451ce0e49ef7a6ccd5f6d52607102eebbeae0173fe6a4d68ff9f5e2b2a2e8f5d6fe7afef49f9b0db9db423d6a2c71e629fc5c3a22146267824
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZD:wd7rpL43btmQ58Z27zw3eZD
TLSH
T1DB748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
3224	xeufk.exe
5028	soebsy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2348	cmd.exe
5956	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	soebsy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	soebsy.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xeufk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soebsy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3224	2520	2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 2520 wrote to memory of 2348	2520	2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3224 wrote to memory of 5028	3224	xeufk.exe	92
PID 5028 wrote to memory of 5956	5028	soebsy.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_e3cc4ce6e4c4bcdfda707a50ae58866e_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\xeufk.exe
  "C:\Users\Admin\AppData\Local\Temp\xeufk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\soebsy.exe
    "C:\Users\Admin\AppData\Local\Temp\soebsy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 21bf82364a295701c15f91a64647aee35b4b849496dfb2b03c8b917e5f7dba63
MD5 4b1703a78bc81775c1e3069522dcbd8a
SHA1 7d5bdf4d85c4ee0117a0686e9dbda279417eba0a
SHA512 5d7d9b0b5307b9eb165e20273b712255f59e86f3c55de3c1eb53354fb65960cd6dd3ac20fc7390221e816dedddefdf7fb674b09a901b0475079816c196e8ba2c
TLSH
T19AD09E1181DED65B0448902B06A5A18DC165485C7FC76B559621844C61C681DB9C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 84c60e8df4414856fd825737d01165350c5851ae55e35814d401246f906431c9
MD5 69475cbd4efdcaa04b54d532cc84f776
SHA1 03db25e467eeec625b337fefab4694ec508d5e39
SHA512 be0a4a5ca4f16b57bddf7fb79a058d18b52e863eff179bbbf293c107ea9c4169b77aaf12eb98fe1cc394b0ddbaafa56b9d55f8cc621a3383236ebe1008a449a2
TLSH
T134E0D80107ABF92A010CC03B09F57ACE817486A9BF4A37677611C65DB2DA80FF49B212
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 73ff696afb9d434a89b2e0eecc006c489f149e2f471898d4f3ec5db3e1aa755b
MD5 8575479bb51acf24c17939ec8dbc132f
SHA1 df00381e2da364be3ebdf89c7456756ed61447c0
SHA512 8993804423eab506cade894bfaf954483cbbd187f7df2d83ae11d9c59f7fccfd8e1ba2d8c18cd04a905fe1e84133fc50703b60f63533ff0a7beb1924ef2296ca
TLSH
T18EF08CC920A0B4423802A213C3A41BC437834C840A879E84040471344931C6C8500341
MD5 SHA1 SHA512 TLSH

Submit Download

xeufk.exe

Path C:\Users\Admin\AppData\Local\Temp\xeufk.exe
Size 354KB
SHA256 4f17c9122482f9b080f83bf00f04d9f5020034ccbb51cafb735d7dd7ca5d131c
MD5 1b3ecc3e4d547fbe44453533902c4b27
SHA1 13b3bc2a407ddef77b04fdf47c8dfa0cde2d2ab4
SHA512 8e2d7254f2d6dadc1a9c36aa3a5b7565536427781264467a9f63648c4791c200c8e40eaba6551974344501d2b6acbde44ca8c84f898a40fc13f56090c4f4b7d5
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZH:wd7rpL43btmQ58Z27zw3eZH
TLSH
T19F748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2520-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/2520-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3224-18-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3224-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5028-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5028-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5028-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads