urelas | feee2a78314cb91a27a5b79aae63735c6f4aee258e578e47cbfb24fbfde5b0b8

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 506KB
Sample261101-ctrpsaba95
SHA256 feee2a78314cb91a27a5b79aae63735c6f4aee258e578e47cbfb24fbfde5b0b8
MD5 566e189f179dc9964f7c9aadedeb5b20
SHA1 ef6fd2adc24983508c5376bf5d1e0b7d438ee25a
SHA512 c4a454407865845c3ae9f58b6a340f712d6245095f2932d92694f0167143d4f8e70291c073939018d0091f31aec51766c1c666717ddbdf4476af8f336cc171cc
SSDEEP 12288:o6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1UX:o6tQCG0UUPzEkTn4AC1+Y
TLSH
T1BBB4AD317240C435E3A613354993E5B05AAC7D345A90E68FF6A8BE396E313939B3724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan upx

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/files/0x00050000000187d1-28.dat	UPX
behavioral2/memory/2536-32-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-35-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-37-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-38-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-39-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-40-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-41-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-42-0x0000000000400000-0x000000000049F000-memory.dmp	UPX
behavioral2/memory/2536-43-0x0000000000400000-0x000000000049F000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
5488	liesz.exe
2536	incot.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00050000000187d1-28.dat	upx
behavioral2/memory/2536-32-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-35-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-37-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-38-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-39-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-40-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-41-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-42-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2536-43-0x0000000000400000-0x000000000049F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2096	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	liesz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	liesz.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	incot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	liesz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe
2536	incot.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5488	3616	2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 3616 wrote to memory of 2096	3616	2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe	92
PID 5488 wrote to memory of 2536	5488	liesz.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_566e189f179dc9964f7c9aadedeb5b20_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\liesz.exe
  "C:\Users\Admin\AppData\Local\Temp\liesz.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Users\Admin\AppData\Local\Temp\incot.exe
    "C:\Users\Admin\AppData\Local\Temp\incot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sannuy.bat

Path C:\Users\Admin\AppData\Local\Temp\_sannuy.bat
Size 384B
SHA256 a8e10c19eaf8defac50f4cf5e90c49886cad1572b8c36eea1ae4762e5bb7da55
MD5 562054bbdf5b4c2421320708a3b4a3ba
SHA1 0d6461341f9fe4bf25aa3bc20259b1b3c5c498cb
SHA512 f049bbac7dae922e598d83b3f971127fb8f9e1f8267d15a8970c005a6ea6df70ac7ab72467280cd45fd1906f5d224c9534ce6864d0f0d58f4eedafe15c521f8e
TLSH
T128E0D142066FDE394508D0AB05B6E44FC165C6583F453F657720C59F21D944DB6E3615
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 462d33256c8c175aa91c29f45d4ddeb77eac2761a8a469a025116c63958d93cf
MD5 54606dc07ff856f7501a2644c38e0524
SHA1 db8fb5446ec809910c6f24a164e3e5aa2a4400e3
SHA512 30a58c165102088bbadb5b760c43460545e46f617ec83d2e11c09291bdc98f44bbdf19de6e24adaf25577859ebf2f2ebf3a92f5de9ec52ae485bd8ba0408ada6
TLSH
T16AF04CE62095B0263112F226D3886BA4BB574DD9164B8D944115B2709874AACC488612
MD5 SHA1 SHA512 TLSH

Submit Download

incot.exe

Path C:\Users\Admin\AppData\Local\Temp\incot.exe
Size 198KB
SHA256 58d5e03628e9b35a5217aa5a2d18388e80be71ff5d03300fca5e67c9f7e65a24
MD5 81bc9daf1c96fbfe417146bad489083d
SHA1 e8d4b40950d76f218bf48b407903d0257318a4a3
SHA512 4695245e7af7f6d597fe201b05edfa6eba7e70cc1b297cd85b92d020fb21d51af7be1c65cd32e2b53d8feae19c9f8d2910c25f1114dce306cfdf01b7c99c0948
SSDEEP 3072:dLeZUwofc1zU9KUgshNIFfF7eO+blJULGaMl1+jhh+PaWY3P2lmWtoutA7E:pXw5MK1shNIFfFCULGvU+3VlBtoSA7E
TLSH
T18814D0512A008859F74C4B32990AF9E409AA9E3DA9D0F54FF53CBD3A6C731835AB714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liesz.exe

Path C:\Users\Admin\AppData\Local\Temp\liesz.exe
Size 506KB
SHA256 405060d7c1c9031655dbda9287fc5e7521589d85cf2b012ccc46c587806bca1d
MD5 d4c29083d693cc150d91a16b0f0aacff
SHA1 4b64b3c941f223b77c9dbb58ee66fedddd80c73b
SHA512 e61f223411f7953646aeb8e86715d8be76a1d4b655088736ee10d2b346dec2216b37c919d8a11104759fbec6faeb0e6969f7c27613cc4c4ea08b846112b5f019
SSDEEP 12288:o6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1U6:o6tQCG0UUPzEkTn4AC1+p
TLSH
T16CB4AD317240C435E3A613354993E5B05AAC7D345A90E68FF6A8BE396E313939B3724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2536-37-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-38-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-43-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-42-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-41-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-32-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-35-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-40-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2536-39-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/3616-1-0x000000000042D000-0x000000000042E000-memory.dmp

Download

memory/3616-0-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/3616-20-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/5488-34-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/5488-23-0x0000000000400000-0x000000000047D000-memory.dmp

Download

memory/5488-19-0x0000000000400000-0x000000000047D000-memory.dmp

Download