urelas | 1843bc280cc994f813a8cde97b4faf7bd913f5c35a87351891d3119654b7f18f

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 354KB
Sample261102-c7fvfadh99
SHA256 1843bc280cc994f813a8cde97b4faf7bd913f5c35a87351891d3119654b7f18f
MD5 f74328103cd3bf0d1d54875adc6b4817
SHA1 c38ebc38f3f3b52336823516e6f2fa43d947ca1e
SHA512 a620054cb115d4d3c1f0e46e872d70ef279643493a86a50aa12aff326e6dc26b20e4b5f391816feea78e76a32d794f295f17596e175561571ac1fd0c748e339e
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZS:wd7rpL43btmQ58Z27zw3eZS
TLSH
T17C748D253580C475F32A07314446FAE00A66BC391999E58FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	jatyp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	fiavra.exe

Executes dropped EXE 2 IoCs

pid	Process
3224	jatyp.exe
2944	fiavra.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
640	cmd.exe
4668	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fiavra.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fiavra.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jatyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fiavra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3224	3992	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe	86
PID 3992 wrote to memory of 640	3992	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 3224 wrote to memory of 2944	3224	jatyp.exe	89
PID 2944 wrote to memory of 4668	2944	fiavra.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\jatyp.exe
  "C:\Users\Admin\AppData\Local\Temp\jatyp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\fiavra.exe
    "C:\Users\Admin\AppData\Local\Temp\fiavra.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1b23cc263753590e80a350298d4e9a00a2a33ff19694699caea2e12b534ee8b7
MD5 272d812a9a802b4db10481df3d0b507c
SHA1 5559e3f342a2afd9f7042f48f52e57ee0ab568ae
SHA512 9dfd3c13aef3354f0e071c97ff61147dbf295536e694b8c72d81d14ff82429f02eba489d614b36b331292cb6c24c92f75ae6ec017816acc6fb07713a1881f594
TLSH
T1B0D0C71141D6DB5F0448A02B06B5618DC0754C9C3F5B3B15DB21C45C21C141DF5C7741
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 711adbd78edc541aff7415328151869a58e578b7516b84264d94e13ddaf18e2a
MD5 4688ba1367a59a6c9aa142396c07bb1b
SHA1 32194fe855644fc9186e37718ef9f6925cff3c64
SHA512 68ef879d3af5a67fb8734c41602eb22b75b9eb7b97f2879cf3e56d5c7103934dab66a32591f28b44997221a161f0c842a50a78a95d6a997e6a62fb3e891e5fc9
TLSH
T1FAE09201018FDD3A020DC01B0AB57C4F81605DA87EA77BB4F622C64C61E282EB5962D2
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e9dbedcadc8707d7a9e4238f94ca30d571fdbacf6dea04088c6e70b0cbf7d065
MD5 78c030f1eb29ff1e4ebaf8b5b51d49dc
SHA1 51cc5e355126c0201700c8200ee111a21d5bbe8a
SHA512 cefe76cdf3b162d4d8d7c90fa59da3944ce898ef01bf9a8b8e855fd67fa88f7a5653ce7eb7c73da429cfa30e4e75ffed6e89bee3fbdd9107a821996a192c62c4
TLSH
T12CF04CD91465B08A3916B612C3955B9527A31DE42A876D8441097231897585CC8DC3D6
MD5 SHA1 SHA512 TLSH

Submit Download

jatyp.exe

Path C:\Users\Admin\AppData\Local\Temp\jatyp.exe
Size 354KB
SHA256 b2e32c8fd4c9fd8b968c21977bc416087d85589d8ce84229f0507e96dda8860d
MD5 248944ef73b735dab372ad18e30e1b9a
SHA1 79e1e53474d5a608c46623b02e043bcd30237b15
SHA512 38898a679a2a5db93d8b1107703d0e392986a0e41d21b8233e7cbe92287b7f5a91a915091acb14a0a7f19e32276de1f8e37b93104e1a47a31b655200b72909e6
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZi:wd7rpL43btmQ58Z27zw3eZi
TLSH
T184748D253580C475F32A07314446FAE00A66BC391999E58FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-27-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2944-28-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2944-33-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3224-15-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3224-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3992-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3992-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3992-17-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads