urelas | e90c6bc5dbb42b387539d39446af310485e441678f08fe354ead7b7cd8740607

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 785KB
Sample261102-tw6p6avwhy
SHA256 e90c6bc5dbb42b387539d39446af310485e441678f08fe354ead7b7cd8740607
MD5 81c01d962959160c73e79bc01b14360a
SHA1 6a6f70ad5441f37e90e1f39e9d01017fd184208e
SHA512 0078807c6649b446db001099406af82c7add216ce6a14a03b4c13bd0f8758f268fda7bd65851a77c6d5a56dc2793452996d5ef60b3cc3f643a71e806e5dcfd5b
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEg4:d7dLBftJLW5YUWLrkJB0PJg4
TLSH
T18A0501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b4d-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-14-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3396-21-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-24-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3484-25-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3484-26-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3484-45-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
4148	cuefj.exe
3484	xuqacy.exe
3320	oppef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1016	cmd.exe
1596	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xuqacy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xuqacy.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cuefj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuqacy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oppef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe
3320	oppef.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4148	3396	2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3396 wrote to memory of 1016	3396	2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 4148 wrote to memory of 3484	4148	cuefj.exe	93
PID 3484 wrote to memory of 3320	3484	xuqacy.exe	95
PID 3484 wrote to memory of 1596	3484	xuqacy.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_81c01d962959160c73e79bc01b14360a_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\cuefj.exe
  "C:\Users\Admin\AppData\Local\Temp\cuefj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\xuqacy.exe
    "C:\Users\Admin\AppData\Local\Temp\xuqacy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\oppef.exe
      "C:\Users\Admin\AppData\Local\Temp\oppef.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 5608f614d3e66297c7ca99a31639df00c6487459d3a6427a35a32d59defb8b4a
MD5 6181f60a7d9842521fdc3ef392196ece
SHA1 e9b9c3fd9a288e0f551c640c1d922675e43ea2a4
SHA512 2413a25cdf5a65b9ed60d047051b44c8ff45cba9228eb513d8afa9274326236300b2788bde04dc028f5e34f06919901f65eab4987b544bddf90cd13a2cad967f
TLSH
T1AFE0D841859EEE6A1509C03F0BB6768D83508DA8BF663B7C7A11C6CD11D681FF5B2282
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 27dc899630e85d219eb48bdcde2ca215baca374c6bb15d456f6ba198a571b0e2
MD5 be3ebca269a09dfdcc2d1f09a964fddb
SHA1 2115a374f4cf7f7d8c768b0d9004023eaecd73ba
SHA512 f7df96ab5a012ea9dcc300c570ff86601371ac7c3ec429c2fcaca8a37ea251a1f35c22511d0f67518ffac63d2d4ebf71a2280610f9cc009d5b1877da5f603db6
TLSH
T190D0C71181DAD79E0458902B0AF565CDC0B54D5C3F473B119721C84C21C182DF9D73C1
MD5 SHA1 SHA512 TLSH

Submit Download

cuefj.exe

Path C:\Users\Admin\AppData\Local\Temp\cuefj.exe
Size 785KB
SHA256 b11d8d52237a62ac850ca15205b9c35279dc5609f6e355ccdd7241bb22b8daeb
MD5 d14d2e11594b717e2c4bd3f207e0985b
SHA1 af8aa283418caa2864f5f1078ed5d09faad6d51f
SHA512 d9d4e3d84bd9c1832e09f4e870d781051692390915f8eb1932d4d35ec7833e54da5e5586efbd070b056597946e16012891a8264e55d4ab55631ebbb751bb2023
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgN:d7dLBftJLW5YUWLrkJB0PJgN
TLSH
T1500501253480C43AF71A07354441EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 20def65d56aef1fd1c641954b379a7f7f39bcea4f6cdaf96e648ffd5b5f4b7b2
MD5 6938b22713df824741f860054ecc370a
SHA1 b7e338a0c9892f0044321aa2bce1cdf15ea4dcd9
SHA512 64f76f2e64c1bf1363e36b0688423f773733c5a7d4a08ca0abe54bccfd05c3a6a670c81a707b56a9955c5cf1342c3e82ee0f7cfe0dbf2f9504152fc07559d5ff
TLSH
T146F09BD711A1B05D7711E712D394076D2BF34DC95E834DA8419972304D35F7C84442D5
MD5 SHA1 SHA512 TLSH

Submit Download

oppef.exe

Path C:\Users\Admin\AppData\Local\Temp\oppef.exe
Size 601KB
SHA256 001c8804065f85a362fa389b5e60cf260880d760479eda14820209bf1cd30113
MD5 5385e0e773a056ee2d863bbed52c8ebd
SHA1 013a9020b5242c58320a769a01f9bf319b6cab33
SHA512 511c3fa509dc5119c1066dc8fab09fa049ef55dfa3e8c72456bb93c412468238be3f62b4a55612a17ae642c67743e2b60327c039f2891734f16215396b858188
SSDEEP 12288:g0/ofE9N0dFaDXAm8Ip9lNfgK4eLS9xHAyZq/G7yq/yWq4qe4MJuC6Pm4:gBfCIFaUmplN4K/sxgyZ9u2JpL4MJuCA
TLSH
T1B1D4238FE3953634FD09677398FE83211128AEDC46854D9272D729CAD6B718F8F68708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3320-37-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/3320-48-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/3396-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3396-21-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3484-25-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3484-26-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3484-45-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4148-24-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4148-14-0x0000000000400000-0x00000000004CB000-memory.dmp

Download