urelas | 54a933dd59943564e8bd32c27e8935bbba937456493a2e5b79353e117c7ef906

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 329KB
Sample261102-p7v1ksas21
SHA256 54a933dd59943564e8bd32c27e8935bbba937456493a2e5b79353e117c7ef906
MD5 a3541e949275fb138fe9778522d9b80e
SHA1 7157a483dfeb7e7ebf3c67dd10dd1d0eb751da94
SHA512 2a17c497df3ef79d44074f3d79b11d71ef2c9e5540cbcaf6c75fe5f99e878fd7c0c079b867ac13f8f296aa8914b9f6f9a93083aa196c77d04701fb8ee565c473
SSDEEP 3072:5dXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisi:5d7rpL43btmQ58Z27zw39gY2FeZlS
TLSH
T12E64AE2535808435F72A07320446FAF10A66BC391999E54FFBB8BD799D311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001a306-31.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
3316	zegyp.exe
4544	pujewy.exe
1016	obydd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1436	cmd.exe
1736	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pujewy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pujewy.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zegyp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pujewy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obydd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe
1016	obydd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3316	1632	2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1632 wrote to memory of 1436	1632	2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3316 wrote to memory of 4544	3316	zegyp.exe	92
PID 4544 wrote to memory of 1016	4544	pujewy.exe	94
PID 4544 wrote to memory of 1736	4544	pujewy.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a3541e949275fb138fe9778522d9b80e_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\zegyp.exe
  "C:\Users\Admin\AppData\Local\Temp\zegyp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\pujewy.exe
    "C:\Users\Admin\AppData\Local\Temp\pujewy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\obydd.exe
      "C:\Users\Admin\AppData\Local\Temp\obydd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 f194544140b33ec6115050e7722ad0a64566f043652add9881faa34f109a007e
MD5 623e8534b0e17dd9c0686b460a328798
SHA1 1d513bf1bd4a2d675292bf3517d9331257f3c767
SHA512 cd9df714e65c91660311a405b0681bf90baff7f29cbf88d23a3883a2b51b36715f01cc69f2a7ce4c243bb6c230b06c3c707a55292ce1b0e9c9e5e2308e217613
TLSH
T143D0C711C1D6D79E0848902B0BB6618DC1B54C6C3F8F3B119721C84C21C1C1FF9C7741
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 c42efd12288e50325ae97c60da52a55e11237c396863473fea7c97165cb19dfd
MD5 6e41a08506f8e9d6b3f695d126b7099b
SHA1 49c451bfc7a2428a8524858a848c00215416e7bc
SHA512 7ebf71bed7815d44a1189e7c72c61c2e61cca6a783d90aa4e9c8169e5cc721fd86c6a6c9a6777808eca716cad1faa5d752289ee6bf6daec90a2bf65b6bb9a38d
TLSH
T14DE0D80142CBEE26030CD11B4BF5BD4DC1505AA8BE6637747620CA4C61DA81EF5F3382
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 1b98faa9af36f767948c5cd2d0ec52008a27678085101dc9f95ddb67af61bf76
MD5 fa464070fa70360179ae97d4207ee1fa
SHA1 d73a7a2a72d405882036497e860b6f01a753f9b5
SHA512 5ece4636b20cb84494991dbb393516af688fea7e5b44ef59fdc29edbce07f19772a530cc1a14d1925566e56697292a3ea689fbdc6a9be279056f481be6cda1ae
TLSH
T152F02BDD20A8A0807502E723E384034913F30DCC3E039DC40105B2304D72C3CC800386
MD5 SHA1 SHA512 TLSH

Submit Download

obydd.exe

Path C:\Users\Admin\AppData\Local\Temp\obydd.exe
Size 136KB
SHA256 5e24856be66c56679d0e81d239ea4fbc3791897991559cc68226fcc071550b43
MD5 d923017009d85e0fb1d05b5b8e7fa725
SHA1 21e04e177aea1e486c9aa8f9e39d740ea518a198
SHA512 714fc3a03e4d39906302259a869e2e584b192caeba04407ffe972eeec2b51034c8ae0bfd7cc387afb15a7fa9b86736196b1888287786b129e8d53972d3548e6f
SSDEEP 1536:jOgVPwzJWY1urHjjwJDxg0trb8jJzPnGC/s+BXLE+ptlf26WLpflZKa:jRwkYQPwtxZMhPGClgWjSvZKa
TLSH
T16ED3AE5256008864F35C0F315916F9E50A5A9D3C68E4F94FF13CBE3A68721D7AAB344F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zegyp.exe

Path C:\Users\Admin\AppData\Local\Temp\zegyp.exe
Size 329KB
SHA256 0057016637c0a7eae103714a5a42adedfc2dc17a1839752e6705fbc655a6b9c7
MD5 ab3ea5c798ee4d1f66f6be0570217741
SHA1 2aa9160a7b24eb8f09793e45efb7bc07b898be3b
SHA512 b23c2add309d71fd3247c1b335927cd7ffb99a9701f41b022a71a8a68f929b5b006d495aad2f9fa58fffe99c9305afd97da244777dabad8a15fb3e935f63418e
SSDEEP 3072:5dXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDQgJl0x2AEMenKbZisV:5d7rpL43btmQ58Z27zw39gY2FeZll
TLSH
T18F64AE2535808435F72A07320446FAF10A66BC391999E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-50-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-54-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-53-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-52-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-55-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-51-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-37-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-47-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-48-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1016-46-0x0000000000C20000-0x0000000000CAC000-memory.dmp

Download

memory/1632-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1632-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1632-1-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3316-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4544-45-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4544-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download