urelas | 1843bc280cc994f813a8cde97b4faf7bd913f5c35a87351891d3119654b7f18f

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 354KB
Sample261102-c7fvfadh99
SHA256 1843bc280cc994f813a8cde97b4faf7bd913f5c35a87351891d3119654b7f18f
MD5 f74328103cd3bf0d1d54875adc6b4817
SHA1 c38ebc38f3f3b52336823516e6f2fa43d947ca1e
SHA512 a620054cb115d4d3c1f0e46e872d70ef279643493a86a50aa12aff326e6dc26b20e4b5f391816feea78e76a32d794f295f17596e175561571ac1fd0c748e339e
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZS:wd7rpL43btmQ58Z27zw3eZS
TLSH
T17C748D253580C475F32A07314446FAE00A66BC391999E58FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4880	huqiz.exe
5824	myuzno.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1120	cmd.exe
2636	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	myuzno.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	myuzno.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huqiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myuzno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4880	4548	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4548 wrote to memory of 1120	4548	2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4880 wrote to memory of 5824	4880	huqiz.exe	92
PID 5824 wrote to memory of 2636	5824	myuzno.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f74328103cd3bf0d1d54875adc6b4817_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\huqiz.exe
  "C:\Users\Admin\AppData\Local\Temp\huqiz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\myuzno.exe
    "C:\Users\Admin\AppData\Local\Temp\myuzno.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 90e4a7d5dc7da96129b38272d0229ed5e8977395001d4f641fa0816967cc4e56
MD5 315fd26e1bb0d6cce482c36d76c02155
SHA1 b868f2257ab6c2f7da52101da0088cfdb555eb43
SHA512 eb6a98aeb1236a0b9edc4488d7766315b2d78ef405bdd2000a363ea0a1374bd3f816152006aab4bb7b206dc006e5f7e1ccc93bdf393dc8f05a59f03d1440b5b4
TLSH
T14BD0C71142D7D75E0448943F06F5618DC0795C5C7F4B3B959721C54C61C141DF6C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 711adbd78edc541aff7415328151869a58e578b7516b84264d94e13ddaf18e2a
MD5 4688ba1367a59a6c9aa142396c07bb1b
SHA1 32194fe855644fc9186e37718ef9f6925cff3c64
SHA512 68ef879d3af5a67fb8734c41602eb22b75b9eb7b97f2879cf3e56d5c7103934dab66a32591f28b44997221a161f0c842a50a78a95d6a997e6a62fb3e891e5fc9
TLSH
T1FAE09201018FDD3A020DC01B0AB57C4F81605DA87EA77BB4F622C64C61E282EB5962D2
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d6b4f910173cf02b3d8462e36ce4bad84de51412e47deaac64a5c0cfbb98b18d
MD5 4e6dc73cca6ca804c3db343d4d51c474
SHA1 c9c19f54b3199f503c4579ac68fbd0e01f91c1ed
SHA512 d1fa6a2f0ce3ddd24bd1195c137e7cc7cad3616b04d0304ef3c959c8f1608b97ec0288ea36d51a77d16c5e2fa93184bf369b057a4d7e4e757a08ee4202558581
TLSH
T1AEF08CCF10A0F0503402B623C384278923871CC816C3DE884048B2708D34ACC8008302
MD5 SHA1 SHA512 TLSH

Submit Download

huqiz.exe

Path C:\Users\Admin\AppData\Local\Temp\huqiz.exe
Size 354KB
SHA256 a5aafa0f3cd51b13067196e55503491e37c7b5a412997c3593133c1bf7dcbe31
MD5 ec1bf42c0c5004806eceeae2e55f1a78
SHA1 dac38779b7f499bd2d89bf2e74fc7f1f7209a904
SHA512 e0a7e8eae0032f2a52f89691e290d81237b928f91c960acc60fb32dc0048f5b14078ed336c98601daec6cc52385378516f82eba1ec46cae9a642c501bfd6a2c6
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZd:wd7rpL43btmQ58Z27zw3eZd
TLSH
T161748D253580C475F32A07314446EAE00A66BC391999E58FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4548-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4548-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4880-14-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4880-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5824-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5824-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5824-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads