urelas | ca337a46413274c41fd43f7d3b298d5eb86698afaead95cd2ed26036e39e18aa

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe
Size 586KB
Sample261102-fgbdtaez4z
SHA256 ca337a46413274c41fd43f7d3b298d5eb86698afaead95cd2ed26036e39e18aa
MD5 e83485f04edd214e442044deadd8760a
SHA1 e71f94741d89965192788caa0f01fd28e45ef367
SHA512 b5e479bc001ea0fc077bd1a647175114fec02b6a1e178681a0a50b135f9d07ebfeeb366bbf2440fb089bc4cef0a05a255a2e7fa81f7d0b9ef2ec2723c1c929b1
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtn:SnPfQpziAkI09HLMgF
TLSH
T1FAD4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3580	wejul.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wejul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3580	3708	2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe	89
PID 3708 wrote to memory of 4920	3708	2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e83485f04edd214e442044deadd8760a_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\wejul.exe
  "C:\Users\Admin\AppData\Local\Temp\wejul.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 a5d88485c4274677ecc912fffcdf9a33817f1578a5c232f132490a120dfc1e15
MD5 b3dba11e289010731b7948eee6fb05ab
SHA1 87287c52d3d8a9411e0c9cac80641788ee17319a
SHA512 7bed1853699990abd96cc6565e7cbc960c0a41d9c9954dc758279615937c5c747271c35c31d03f81158b7913680937ee422f6f1250a879e0f27cbe944117cbf8
TLSH
T15EE04F0541AFDF7A0605F01B0ABA298E816059E93FA63B2A7720C65C62C198EB9D2242
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 6a66e1d9120186ce7410be32875cbae0e64750e125cbb5901dddc36c51818389
MD5 cbeec0df937124e3f44ae256d00427aa
SHA1 a2d2e8ea2c2e41456599f2dad2dcabc2620fe96c
SHA512 55689d7de37df36feb5a6fb0433ca1f1ad784ccbbac95a956b15af0648ea01f7ab207be256d48ddf223f651041415c3653efb3440207adc1ac280eb19c316552
TLSH
T161F04CD62061A1553216E722E3A413A91F934D892E4B4D684246B1B08C75ABC8418B95
MD5 SHA1 SHA512 TLSH

Submit Download

wejul.exe

Path C:\Users\Admin\AppData\Local\Temp\wejul.exe
Size 586KB
SHA256 24f8005c067ed91099288597d8114dccef4b907b3beb2fbbc0263b9404c32ef4
MD5 bdbb7fcdbcdf16c4b71eb9b3412608ed
SHA1 6177bf9b25c4a1c245d67c9101c9ed8037be5100
SHA512 eb9109788cef0ffb6f398c24e581e996c7861bdaf492e9ce86dc92b20909d2aa7455776327a5cebe3decea807cdc66c4620469d9b002fd65e7a235b5a5a6e02b
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgt8:SnPfQpziAkI09HLMgS
TLSH
T162D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3580-12-0x0000000000F20000-0x0000000000FEF000-memory.dmp

Download

memory/3580-14-0x0000000000F20000-0x0000000000FEF000-memory.dmp

Download

memory/3580-24-0x0000000000F20000-0x0000000000FEF000-memory.dmp

Download

memory/3708-0-0x0000000000F50000-0x000000000101F000-memory.dmp

Download

memory/3708-1-0x0000000000F79000-0x0000000000F7A000-memory.dmp

Download

memory/3708-21-0x0000000000F50000-0x000000000101F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads