urelas | 1a6b37c1008e7648060d024142202916c0ed42eff9ce3bd388572869376e9431

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 1.3MB
Sample261102-s8hy7abs5w
SHA256 1a6b37c1008e7648060d024142202916c0ed42eff9ce3bd388572869376e9431
MD5 87e6bd49ad25409e4badc49288b700c3
SHA1 b652145d778f4baf5c78e89ae10b7322950051b0
SHA512 f0900e308084cba0d2f41918fe07bbe2eb5848c09167cbf193258e10435455f110d2314a6f9f92da1e79a71008423a602363174defad681a0beff8ff46e5255e
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nP:+rt4/NArwjs5pAVJ
TLSH
T183551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
1052	doiwg.exe
5752	gyzas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3480	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
296	5752	WerFault.exe	92
1572	5752	WerFault.exe	92

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	doiwg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	doiwg.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doiwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gyzas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 1052	5128	2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe	88
PID 5128 wrote to memory of 3480	5128	2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 1052 wrote to memory of 5752	1052	doiwg.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_87e6bd49ad25409e4badc49288b700c3_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Users\Admin\AppData\Local\Temp\doiwg.exe
  "C:\Users\Admin\AppData\Local\Temp\doiwg.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\gyzas.exe
    "C:\Users\Admin\AppData\Local\Temp\gyzas.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 256
      4⤵
      Program crash
      PID:296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 276
      4⤵
      Program crash
      PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5752 -ip 5752
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5752 -ip 5752
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 8b0b9f95534304156131a29943ca8cfb1d5df77490179a05c6f86b72016fd241
MD5 2913a68c179b82b9317199e3d2db07b3
SHA1 b1a8b1542feb9d56608c3cc53fce1bbfd1fbeabd
SHA512 ab4579f5f578f612d93d2a496e56e1f5cd39652fa5ea7742ff012c87b4cc4e3dc2dedee0ff01390d33d764fbcc5470215e304a62d5dc73d2c37cef479399924e
TLSH
T154E06800405E896E000CD02F4AB8F28D81315EE9BEE337A85630CA0D32CE88F75C2301
MD5 SHA1 SHA512 TLSH

Submit Download

doiwg.exe

Path C:\Users\Admin\AppData\Local\Temp\doiwg.exe
Size 1.3MB
SHA256 be09dbfdfb00d68741b30105e0baf25e9aa985020f88576bf2a0cbaa8dc457a0
MD5 e252fc9ed53f3b42329a028617b9d54f
SHA1 5c585fa2d81bce21bff16b8cae096cb343de8a50
SHA512 36326a2469e6cb05e77e2d1e8c4c6a9d553aa9522ccd91c6ae4c383e127a490f52ffd61211196e0056581fbe2822e096cc8e9d4b52170e46ffde80b27eb98db6
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+ng:+rt4/NArwjs5pAVi
TLSH
T1EB551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 2416a0b48323d71c6ae2f0d051a8b9f9fce433055e4b383b6ae150016e5d49bb
MD5 da932c78010aff1fc62356ec99f61ae1
SHA1 2e1b3a0a541c030451e665a91f0d25526a111153
SHA512 d819fbe21a3873c2976d174db781af041ea3628fc7a1cfcb56cd3ff6871e1b97967909e4edf1470173dde60e93d307887df44516213ff64d889949d00f57969d
TLSH
T1BDF04CD51061B06E3611B922D7944BDA13D34E491943AD944189B1314E3982C4594356
MD5 SHA1 SHA512 TLSH

Submit Download

gyzas.exe

Path C:\Users\Admin\AppData\Local\Temp\gyzas.exe
Size 231KB
SHA256 5ec5911df9d61687d6867b89f6f8b53b1a23fc2eb2567fa5f8529c8e2efb5708
MD5 cf71687d10d0c3bd1bacf82eca829c99
SHA1 d75a361ce8ac268ba12cfe0a1edb735b4a0a2e03
SHA512 dfed996c647984bcd94eb99cdf7a58e313d51998790ed2a26a756051343e3ec53868b04e8045bce98e78bb0a81f30bf4051fcc18e63a41bd5d29d65779b904e1
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiK:z6r5cTfS/ZPHUWoQISzqJBpiK
TLSH
T17434D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-13-0x0000000000E80000-0x0000000000FD7000-memory.dmp

Download

memory/1052-14-0x0000000000EAB000-0x0000000000EAC000-memory.dmp

Download

memory/1052-24-0x0000000000E80000-0x0000000000FD7000-memory.dmp

Download

memory/1052-35-0x0000000000E80000-0x0000000000FD7000-memory.dmp

Download

memory/5128-21-0x00000000009C0000-0x0000000000B17000-memory.dmp

Download

memory/5128-0-0x00000000009C0000-0x0000000000B17000-memory.dmp

Download

memory/5128-1-0x00000000009EB000-0x00000000009EC000-memory.dmp

Download

memory/5752-33-0x0000000000F00000-0x0000000000FB3000-memory.dmp

Download

memory/5752-36-0x0000000000F00000-0x0000000000FB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads