urelas | 5c64a93618bd725bb863e55cc197c8be76bc4ffbe87983769f8bf94d811d6de3

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 411KB
Sample261030-e413baaw5l
SHA256 5c64a93618bd725bb863e55cc197c8be76bc4ffbe87983769f8bf94d811d6de3
MD5 53c02b6b5957feb5aca926eed0db78ab
SHA1 3c51f1994b306d1c96f465bdde32595ae39d3bec
SHA512 d5573198f5e43518c36d9570af9da2830e0a150f0ee595c9cab311ffb8bb36b24ba9f3ffbc4c0622e255c00d400a18ff785a40e1cafcc721fb74514b717a63d2
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohV7:YIfBoDWoyFbkU6hAJQnaX
TLSH
T13B94BE253540C436F3290B354855EAB10AA9BC3A15D9E48FF7787E7A6D321938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
3316	umfur.exe
4880	zybiaq.exe
3096	wonuf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4872	cmd.exe
1336	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zybiaq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zybiaq.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zybiaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wonuf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umfur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe
3096	wonuf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3316	1324	2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 1324 wrote to memory of 4872	1324	2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 3316 wrote to memory of 4880	3316	umfur.exe	91
PID 4880 wrote to memory of 3096	4880	zybiaq.exe	93
PID 4880 wrote to memory of 1336	4880	zybiaq.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_53c02b6b5957feb5aca926eed0db78ab_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\umfur.exe
  "C:\Users\Admin\AppData\Local\Temp\umfur.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\zybiaq.exe
    "C:\Users\Admin\AppData\Local\Temp\zybiaq.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\wonuf.exe
      "C:\Users\Admin\AppData\Local\Temp\wonuf.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 c46283162d9a5dba1d795df228d5a6303fdee638e989b97ec7784520739f6314
MD5 bd5d12532787b0c09d42fff995c9ac20
SHA1 ab309e463d26a6fe100179f4bd37189d6e13a533
SHA512 a7883452121da9f1784bcf61594d577f8a1f09dc554309e519c4c85478afdd632b1d4e2d386577b75d2cbda41cf9ed99f2755923a6b71d56d54593a6f419c4ad
TLSH
T17CD0C75142D6D75E4448906B07B5618DC1754D9C3F477F11DB21C85D31C641DF5C7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 60db0e9471f81e28e680921401d41dda3f926df169af74ab1dd5d44be1af24e5
MD5 fe61e78fc29c2bbbcffec2452ff36f82
SHA1 c22fe000c6097aa3686f5b664b1d8ba1d663230b
SHA512 0a32c9f5d5833037dd9cfd9d7266d56b9d3e6ebb87b1f63b37644d5978785be1dfcec143998aaed73823022da56bec603aee9861fa2e309cc752205a819d66d6
TLSH
T1F8E09B0542BFDD3B058CC11B06ADB58F8168A5647FC62774B734C75C52D689EB5B2602
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 812aaf6b846cdc79544989b03cd03b6d2ff6e9530565f223696db317fc01dfee
MD5 bad71e0c757a202e3db71c3e3a9f6feb
SHA1 5bac86e5a20508f821cfea59d076566c59da331c
SHA512 66c00eba8bc706b79f2b6cec7951f19016dabed1dac93e2ad5b7c6bbcb0f4ce800bbf12af307bd1d983e3dc3392a2fabd50b2ccda35ec97f7ac0839c2d00e220
TLSH
T1A0F04CD52165A4967516D627D39417A937930D882E474C840218B1718536CACC414355
MD5 SHA1 SHA512 TLSH

Submit Download

umfur.exe

Path C:\Users\Admin\AppData\Local\Temp\umfur.exe
Size 411KB
SHA256 0da4bdf370084d08d0bc65a63baba065b4c2f92e1f37367c2bee0c809750bb83
MD5 2f9df4a58af76275e885a2dabb12048b
SHA1 0b1b4a2ecda23a2491cafaf83693c6273b9b9ef2
SHA512 37ef884f75fbdcbc2fff69c7dea8964925504f5caa763cfb2f644621f6879599466c51e723b5ef313c3b65878d4c238323af707761e714920e0ea137a0b2c51c
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVz:YIfBoDWoyFbkU6hAJQnaX
TLSH
T1F594BE253540C436F3290B354855EAB10AA9BC3A15D9E48FF7787E7A6D321938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wonuf.exe

Path C:\Users\Admin\AppData\Local\Temp\wonuf.exe
Size 223KB
SHA256 89c4e6a38133a0ff8e81bc421a96438e31543eec07aaa9e6ef664ba4c6a22319
MD5 b7a18e1ec30c4876328518c286db6a6d
SHA1 3f7a703ff9760c1f7fb77ecdcda39d9129d81d90
SHA512 aea33ac0d3776cba81ed1a8a7ec9cb9fdc13e264f99f1408107a735a3723154bf3f5cddaed244b69f8f187349e8edf575359bb18758ab5ed5424ec61b49d66c7
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3a:unFhSIkAyDgjtS/FZI
TLSH
T15B24E041AA018888F38C4B316A17FAE449858D3C59E5F51FF5BCBD362D3628729B748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zybiaq.exe

Path C:\Users\Admin\AppData\Local\Temp\zybiaq.exe
Size 411KB
SHA256 916231c6144ac43fecbe1e794d63ddf651185fa4d1c5950fc3790c897fd0b6f9
MD5 2113dfdec66bba04f44c88484556344f
SHA1 20f8b81dc0dbc54e9e05071910086a3c66780fd6
SHA512 827b2e969c9996cc345ae3ff0b31f74766ddf2ed84bc3e1004b3671adc78ed7fa0ce5e57831338973d065f8c09b4b251337c4a38c98cb1f07c98d8fac278b469
SSDEEP 6144:Y5SXvBoDWoyLYyzbwOC4DYM6SB6v+qLnAzYmhwrxcvkzmSB7ohVD:YIfBoDWoyFbkU6hAJQnav
TLSH
T12094BE253540C436F3290B354855EAB10AA9BC3A15D9E48FF7787E7A6D321938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-0-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/1324-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/1324-22-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3096-60-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3096-59-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3096-57-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3096-45-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3096-58-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3096-56-0x0000000000C20000-0x0000000000CC0000-memory.dmp

Download

memory/3316-32-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/3316-14-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-34-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-54-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-35-0x0000000000400000-0x00000000004679C5-memory.dmp

Download

memory/4880-31-0x0000000000400000-0x00000000004679C5-memory.dmp

Download