urelas | 4666949d9d1d33441f2ea0ee12eba75d3776a67d44f9744a9f92340d786ccfb0

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe
Size 175KB
Sample261104-1lay3azz4n
SHA256 4666949d9d1d33441f2ea0ee12eba75d3776a67d44f9744a9f92340d786ccfb0
MD5 49b61a3d560e7ba63fbe0782eb3dc905
SHA1 c51f28461335be3a05e508d1270a19e879cc71b7
SHA512 0ea49a13c7dd15f07434dbb55ed9f1144c6bca9480125345f803ee08a78495948e0dae77d8d194629380bd3822cea625032bc56be37dc2f6c136d67fc9c1e9f0
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2XW:wuYndSW7gILCLIPtqVu5Dqpxhz2G
TLSH
T14A0407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
2744	opert.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opert.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 2744	5944	2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe	90
PID 5944 wrote to memory of 4604	5944	2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_49b61a3d560e7ba63fbe0782eb3dc905_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
TLSH
T13CF012C110B7F0077123B201C504033437D3ECCD00438DD5069A73398A35C6C4514178
MD5 SHA1 SHA512 TLSH

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 175KB
SHA256 73e8d74f9032fd7c79807201799e4beb6edf5d0c069f153fcdfc12591b30d8d4
MD5 5bb4653b15dd87f52ae5bab6ed6ce1eb
SHA1 d22256a4a26f2483a7dc5d228b34da70b89030cd
SHA512 3d611dd138d7ee6d269c5910b14097c26d2a7b490a143e6bd9d4bcd3109d37ccc95371e05a7c6c200db391095bcfa2b9ddfcfa86c145c13d35eb8dafc97bfb7e
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2XN:wuYndSW7gILCLIPtqVu5Dqpxhz29
TLSH
T1E60407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 22893f909227bf5057480929f7fe7dfd03668d2d38dbd2f83c251f5e2897c04c
MD5 ef92898e37e58a8c96a07d75ba47643f
SHA1 77e04cf777a61b9faaf97217286160f554c0e403
SHA512 c8b97316bbf8cb2a760c0b90a560cecc5d6466b90a67e53ffa4ee2980f7246fb1d92dd665ad0dbcbdbde6c3b0c9184f6ab3c484e044176c446f43ff575cc129c
TLSH
T13CE02001318BD96D080C90170979B55DC2101C682B4A3F045711CA45709BC0DB496313
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2744-14-0x0000000000F34000-0x0000000000F35000-memory.dmp

Download

memory/2744-12-0x0000000000F20000-0x0000000000F4F000-memory.dmp

Download

memory/2744-24-0x0000000000F20000-0x0000000000F4F000-memory.dmp

Download

memory/5944-0-0x0000000000BE0000-0x0000000000C0F000-memory.dmp

Download

memory/5944-1-0x0000000000BF4000-0x0000000000BF5000-memory.dmp

Download

memory/5944-21-0x0000000000BE0000-0x0000000000C0F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads