urelas | 8aff40c265ff68670ea7bcfa9db8283bb494fcfd2e1d7470bc707a240f798b04

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 00:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 802KB
Sample261029-aq2dpshs6j
SHA256 8aff40c265ff68670ea7bcfa9db8283bb494fcfd2e1d7470bc707a240f798b04
MD5 c09668081074ca65a071ebf075270ab3
SHA1 59b6a6332e832e471f5b581bdeeb261b4b2055c2
SHA512 eee9dbb0e4623e2742eb21a9e9788b4c24239423a6302a7424dde5fc1f046a5f4e518597107fcd574860245152695b37fe0033bd6d000849336c66acc3d42cc7
SSDEEP 12288:+UyI6iMZU/cKlUR5Dlzwl6kQIbbNIns6A5MjR5/Tkou8Lpq+TN4ohzf76I4BcHii:WVrU/cK8uQGeTASRuj8h5blf7OBW6Y
TLSH
T17505F1217190C035F3A6077589A2E1E54A647DB817A4E48FF6E87D792A311E7AB3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4296	vehya.exe
244	xaqyhy.exe
4196	jomac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5824	cmd.exe
5348	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xaqyhy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xaqyhy.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xaqyhy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jomac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vehya.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe
4196	jomac.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 4296	6076	2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 6076 wrote to memory of 5824	6076	2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 4296 wrote to memory of 244	4296	vehya.exe	93
PID 244 wrote to memory of 4196	244	xaqyhy.exe	95
PID 244 wrote to memory of 5348	244	xaqyhy.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_c09668081074ca65a071ebf075270ab3_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Temp\vehya.exe
  "C:\Users\Admin\AppData\Local\Temp\vehya.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\xaqyhy.exe
    "C:\Users\Admin\AppData\Local\Temp\xaqyhy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Users\Admin\AppData\Local\Temp\jomac.exe
      "C:\Users\Admin\AppData\Local\Temp\jomac.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 df9128b0ecdc749a4cd53864b7118eee98614c3935c3cc8941622e89f75cdb0a
MD5 76c975aba84283c6a6b7fe5bb6c02ab1
SHA1 039f57957a95bb74632ee04614215708c80c4066
SHA512 4e2661d37290727c1d936c73ba508340fc6f15693863df11452efc1f8940a9f4eca0085e7db558e0c90667b5b6a3249b6f390677d0b838754e259b72e32426db
TLSH
T1B8D0C71181D6EB5E0448D02B06B5658DC0754D5C7F8B3B11A721C94C21C1C1DFDC7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 eb8cc706b20a71b925ac53e045011507a49293e761e54ee226c1d0051cd954f8
MD5 8efce34db7301dbf563790bfc62197fa
SHA1 0c72e73276ad1601455402671c632de43b924f58
SHA512 a0c21ac802fd739560713567bab7d6a267dea3f59d681fd37be917eef0923b489b8a19760dd30b6baef518d40c1bc6f9c06d3c0cbf6b1a303f8ef284bed6895f
TLSH
T12EE0D141019AEE7A050CD02B0DA7648DC161966C7E8637E47635C76C51F641EB8E6701
MD5 SHA1 SHA512 TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 17ad4ccaaf1e881ab269e2be84c80f8919dc285a1300afa506ff93d76009891c
MD5 d3e09d98df37ff9067b5076b1f10ebf8
SHA1 b399359451030ecf526966990a1585a13b456658
SHA512 fb4bbed0b3549a8d4cc230638d30c4f9fc24e3cb2ed46336f2a4a2ea99beb173711dbe8e823fc9443d0952ad4647ba265499cc01e1f38a83c2c786cacaffcbab
TLSH
T19FF02BF32038D0483302F203E381538837830D940EC38C980145B0F04E32EFD8404304
MD5 SHA1 SHA512 TLSH

Submit Download

jomac.exe

Path C:\Users\Admin\AppData\Local\Temp\jomac.exe
Size 545KB
SHA256 356d8bdfacb2af834580312443419595ad7894f598590bb7cd1d85ce352687ac
MD5 4502160f05027b9300601bfc7f5b6c22
SHA1 a1e49418cfed3ccbdba460a37405b05c63a9bc81
SHA512 7c3a2b89d73aadf7f586bfe2144172d76d38f632d762c7828458d8186f0e2e98f2e3c899469d27046832942a71640be8e4c9a00325d2f0d099863a92f56e8db3
SSDEEP 12288:satTDPMEFr/BmNl75PbPgs9Z6l0YOASV54IRriXKppCalfx1UOyq:7TTO3Ys9ZgE5/JCalfx9yq
TLSH
T11BC42352FAD2554BF91C5031AA8B94660BA8CE3C23410D1B76E2B71F5E36366F7782C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vehya.exe

Path C:\Users\Admin\AppData\Local\Temp\vehya.exe
Size 802KB
SHA256 bbfea491c3d2842c9427089e0d6df83589a57157ef50d435384d7f6871d29efa
MD5 023f3899fa5d7577237a20e9df184f12
SHA1 4d13a47c7fbaea242d227770dae12035a9c3ac30
SHA512 3771d33f42e1f24dae8cd382fd5d3af32ddb1390af434b71d7400c5d6580d3981325e8fdaa995c6bf44df71c736c9adfa9936f1ac750f8b7709794e0a771ca6d
SSDEEP 12288:+UyI6iMZU/cKlUR5Dlzwl6kQIbbNIns6A5MjR5/Tkou8Lpq+TN4ohzf76I4BcHil:WVrU/cK8uQGeTASRuj8h5blf7OBW6/
TLSH
T10505F1217190C035F3A6077589A2E1E54A647DB817A4E48FF6E87D792A311E7AB3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-45-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/244-25-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/244-26-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4196-37-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4196-48-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4296-24-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4296-14-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/6076-21-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/6076-1-0x0000000000423000-0x0000000000424000-memory.dmp

Download

memory/6076-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download