urelas | 78e10c0d545cde22eee7a1f479bd1721bbb4e7b82527762592a795cc773e5794

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe
Size 555KB
Sample261101-xtgj2adb25
SHA256 78e10c0d545cde22eee7a1f479bd1721bbb4e7b82527762592a795cc773e5794
MD5 e367e729395d3a208819e12c12e20cb9
SHA1 ead697fc503f9deae4453b38f426d2b7940fa58b
SHA512 4a5067ccfb3c035517bfd2fe8eaf4caaf8f68261cfba33b6ac00e861e363c5466c43c21d36822a9957d6299e9181544e25031579cdf47f2298f8aa5731e5d1c9
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gzlf:+rt4/NArwjs5olf
TLSH
T13CC4BE1136908435F3662B750996E6F41AB97C384AA4D68FF7A83E395E301D38A3734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
788	xumee.exe
1944	inten.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3204	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3260	1944	WerFault.exe	94
4860	1944	WerFault.exe	94

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xumee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xumee.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xumee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inten.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 788	4988	2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe	90
PID 4988 wrote to memory of 3204	4988	2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe	91
PID 788 wrote to memory of 1944	788	xumee.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_e367e729395d3a208819e12c12e20cb9_elex_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\xumee.exe
  "C:\Users\Admin\AppData\Local\Temp\xumee.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Users\Admin\AppData\Local\Temp\inten.exe
    "C:\Users\Admin\AppData\Local\Temp\inten.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 256
      4⤵
      Program crash
      PID:3260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 264
      4⤵
      Program crash
      PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1944 -ip 1944
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1944 -ip 1944
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 c27398e851d657b0a4c1b101e9ed4d380bca9b123ff89daf3264e87277649f86
MD5 9b0c4f676ff7a261e56fe5066506f0b2
SHA1 5cec414be93276872714be8bf6288e3deabf0715
SHA512 176d8c992030804ce934c9cb854f53de6ae2b7fc506841fc715d34ab9eb523829ad1415eae37c1dfce628a792ebbbe3986521d76cb108e91e86c839343b30be1
TLSH
T1C3E04841805EEB6A090C911B0D7D794DC2744668BF592F596E50C79512DE80DF9E2211
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ff7cce24d987a4965c1254613ca777ada09a389a42157d1732699200ac9dc626
MD5 683beaa9c8cffd22bf075263ae7cb250
SHA1 0f3b5a765c17340ffe14749145b9b3a1d9c87e6b
SHA512 851a7c04d8c75bc497c6289799078377ae8d26d160716028d3a9795a4e4002fcab0381524178ea87101c4ca019b9b8e3e7b7e201c14ef8f4ff3eb187f493dafb
TLSH
T1E1F048D261A5B8663A12EA17E2995FA823930D892D839CA04208B1A1AA75C7C8484227
MD5 SHA1 SHA512 TLSH

Submit Download

inten.exe

Path C:\Users\Admin\AppData\Local\Temp\inten.exe
Size 231KB
SHA256 8e06ddaa2d4db2907f3cf955f65ef2f20186b4d910d4a9566e60e427f1c25652
MD5 332c303afd77ffda9399493beb4d0c8a
SHA1 4801b790c3575ead61468e1b0a17f6cce3a50527
SHA512 966762189473371f79d4967e3085ba392b8d3822ef70d49146e02ab4fb951fbc97edb278c8650ad05bd43d1afc6e9dee8884d0001055320ff76d47e35e8087e0
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpig:z6r5cTfS/ZPHUWoQISzqJBpig
TLSH
T1B234D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xumee.exe

Path C:\Users\Admin\AppData\Local\Temp\xumee.exe
Size 555KB
SHA256 6ac5adae500af014e94bbc07ef4c67a6f1354cf9685d4b6caf12ea74428a84db
MD5 226b9f4832e0f28fd25cbc9e996f15c1
SHA1 cb93f1c729ebbd257f4ee7a14819d50a699e22cd
SHA512 6f25ce33953b631c1ac9d0ccce3a370e3a2fc94c67658465de7607db1dfdf2ff883a4a65e786a0af5ef33fe57edb70a85cf4d4dba8d027828c7dc00caedc7c04
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gzlj:+rt4/NArwjs5olj
TLSH
T144C4BE1136908435F3662B750996E6F41AB97C384AA4D68FF7A83E395E301D38A3734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-12-0x0000000000F70000-0x0000000000FFF000-memory.dmp

Download

memory/788-21-0x0000000000F9B000-0x0000000000F9C000-memory.dmp

Download

memory/788-24-0x0000000000F70000-0x0000000000FFF000-memory.dmp

Download

memory/788-35-0x0000000000F70000-0x0000000000FFF000-memory.dmp

Download

memory/1944-33-0x00000000008F0000-0x00000000009A3000-memory.dmp

Download

memory/1944-36-0x00000000008F0000-0x00000000009A3000-memory.dmp

Download

memory/4988-20-0x0000000000B70000-0x0000000000BFF000-memory.dmp

Download

memory/4988-0-0x0000000000B70000-0x0000000000BFF000-memory.dmp

Download

memory/4988-1-0x0000000000B9B000-0x0000000000B9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads