urelas | 630f3165556635260dc150f9f4d546eecb93b42c1a3c3963cd673c12acc5f6f8

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 785KB
Sample261102-dbj3naev51
SHA256 630f3165556635260dc150f9f4d546eecb93b42c1a3c3963cd673c12acc5f6f8
MD5 f62fe1e051fa5bc86f9df647df7cecd3
SHA1 e6559fcde328ac9f0e0b268c83f3ebf3d5d3a065
SHA512 6133d566313470a3a365c05c5ffce966e5a5689f54fc8ae613c3e91ddb20b28734d58a2b1c55173baf56ca1cea6713c1504dd2d127cd6c6a87b87fbfa9eb42f2
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgL:d7dLBftJLW5YUWLrkJB0PJgL
TLSH
T1950501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4960-0-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4b1-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4736-18-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4960-21-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4736-24-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5800-25-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5800-26-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5800-46-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
4736	yfmul.exe
5800	buxoqy.exe
3776	ivhuz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2596	cmd.exe
5512	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	buxoqy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	buxoqy.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfmul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	buxoqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ivhuz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe
3776	ivhuz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4736	4960	2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4960 wrote to memory of 2596	4960	2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4736 wrote to memory of 5800	4736	yfmul.exe	92
PID 5800 wrote to memory of 3776	5800	buxoqy.exe	94
PID 5800 wrote to memory of 5512	5800	buxoqy.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f62fe1e051fa5bc86f9df647df7cecd3_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\yfmul.exe
  "C:\Users\Admin\AppData\Local\Temp\yfmul.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\buxoqy.exe
    "C:\Users\Admin\AppData\Local\Temp\buxoqy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\ivhuz.exe
      "C:\Users\Admin\AppData\Local\Temp\ivhuz.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 9938949d8758fa4cbe5c3efc57d037ed81e584bec1a46111046917b6d49d0db3
MD5 678ff7febfbbf0900d613aaab6c13e41
SHA1 29377825c84441b06b40160828ff7b0804399d38
SHA512 e0fdd1bc2cba5cb8ed27f6b0a4ff0b6839f6ea2fe164fe83cc88b8ba8e81313e0b425048dc434b3a8a171be9d0fc391c467bc9af40466c0af7e55751acd5447e
TLSH
T167D0C71181DAE7AF1448902B0AB5618DC1759C5C3F473B11D721C44C61C581DF9C7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 282ecbc50921282f888ebc3232c8019a6b897493e982d31c194d121745f79e6d
MD5 dbbd6a95ce2240d51547ad33dd7120ec
SHA1 8669c6232be4ebd9b1a522c8ed7721393a8e00f6
SHA512 aef89f6abd1fc4d98eca37805ba9659af01bb89df90918f2cf1b08be7467c73eace1b870524aa8db27810e74bf1fbba448c530f453c809cd211f63ea93cf2fe3
TLSH
T1EFE09206024EDA6B010CC01B4AA5A68E8160A6BC7EF637B97611C14C12D286EFB93247
MD5 SHA1 SHA512 TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 03b0a046a4cdfe51e5e94d7d249e72a16942ffa160a58b8d87d0b38057f3e495
MD5 381ec04f926d9d8fa7d514d4de735600
SHA1 5f8462372d01126a5d594cec57e53037d7f0b7f2
SHA512 fc4de3dad7192d90f80f66385c4564efbdc6e05f8c4488a73b4bd796cd1ec7a0fe291bc0fa598a5ca68fa58f92c4776db77241f9fe4b7eb7839ae78871d9a8a5
TLSH
T17BF08CC21090A0003B01FA23E280278B23830D982E8BAD400104F0708632C6C4800241
MD5 SHA1 SHA512 TLSH

Submit Download

ivhuz.exe

Path C:\Users\Admin\AppData\Local\Temp\ivhuz.exe
Size 601KB
SHA256 e6a21d00d7111d913936a503a40716cc610e8c043732fe7332c58ab46e14657b
MD5 71fa1c12ac952c21896e7c25ce2b7f2a
SHA1 89db7681cd8131e55a83942befeba7ffb8297357
SHA512 9dc584dcc5fb5b0f57082d26b3f14832425b69aed4ad5fa24f36fdda3960f6f4fc082f25b259a8afc577a76959e394791297aa8d9a1e66203aa59efd5e385055
SSDEEP 12288:g0/ofE9N0dFaDXAm8Ip9lNfgK4eLS9xHAyZq/G7yq/yWq4qe4MJuC6Pms:gBfCIFaUmplN4K/sxgyZ9u2JpL4MJuCU
TLSH
T139D4238FE3953634FD09677398FE83211128AEDC46854D9272D729CAD6B718F8F68708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yfmul.exe

Path C:\Users\Admin\AppData\Local\Temp\yfmul.exe
Size 785KB
SHA256 136f60429d165778b3df33e95376da06f42e442d97501aae67dab9c8b37dd9cd
MD5 7c164bfaa71e855cc62ab6661d4cc8c9
SHA1 1312c48f654ab03f07582b6a150cad8ad58ad8d3
SHA512 92fe1e03ab51d3f61522594115a9ecde4efd6fb599adedd780d06a008af0654d308725c607cdf1071bdb528cc5b46caba1a2f29c24fd163f85e59ab96e095573
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEg+:d7dLBftJLW5YUWLrkJB0PJg+
TLSH
T1580501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3776-48-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/3776-37-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/4736-18-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4736-24-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4960-21-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4960-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4960-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5800-26-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5800-25-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5800-46-0x0000000000400000-0x00000000004CB000-memory.dmp

Download