urelas | 10eed2c64f04f8f9981285fc066aafa909b298e03e744a811e48aabf79c23ae2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe
Size 803KB
Sample261104-ken94sbs3l
SHA256 10eed2c64f04f8f9981285fc066aafa909b298e03e744a811e48aabf79c23ae2
MD5 c4eedbd940ef6368947a21796d3587cc
SHA1 1c57e692940eadad75a5ab3e4243e64a24157e2a
SHA512 45567fedf3cd4753b19ddd59686bc74d50e46af386c979e350255fa87c79371fdb5aa3bf0cffe600066c2008c022d816ecd859c7298e74a86f97793140ae04b2
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkioF:dnPfQpzNgqAkI09HLE
TLSH
T1D905C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
2176	doumo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doumo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2176	1968	2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe	90
PID 1968 wrote to memory of 4556	1968	2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_c4eedbd940ef6368947a21796d3587cc_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\doumo.exe
  "C:\Users\Admin\AppData\Local\Temp\doumo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 ced6c619003a8b3c68eccc5d3c7c722f13467683f9658d15c23106fd24727dd2
MD5 42989be3c0da8850f2b4755d977b2993
SHA1 17f77749fcdceca845ee25163f89dbdc3fac38d2
SHA512 18e29a730270b4b679ef402b7b88e2bce804e36f428d9d89631d9b318fb09a3d48ca35fe51e50ef4ab1d5977c1bf6796c706ea42286fed532e18957b01deee1d
TLSH
T1B4E0DF2143DBDE7E0108E06B0AB5688EC26898987E863B30AB10C5ACA2C145DF9D3252
MD5 SHA1 SHA512 TLSH

Submit Download

doumo.exe

Path C:\Users\Admin\AppData\Local\Temp\doumo.exe
Size 803KB
SHA256 dc084dba3a740f493bbb68f50c6a83963df647a1d2f40e505222e233e8016b3f
MD5 6c6a7c0ffe862abbf6c418656ea45c10
SHA1 799aaa7f39ed1d6177716cd19555260550b05f8d
SHA512 df9c7c0a6d23298633f478dd7801005530ffff4e70052eadf1d2b81c3d1615253fba9fb0db85d72fe5efcf6255a53b7a26daa4a62f49564d3101c932cd818f2c
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkioH:dnPfQpzNgqAkI09HLW
TLSH
T15605C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5590733f16ba48e8347ee80f44d1861ba7af217dc870c83d6681231b5f4364fd
MD5 4686fedeb4ed6dd8194c5f020c585f9e
SHA1 4f3926e0900b49adadfbae4f286d4fe6aadaeea4
SHA512 a6011777bb081342d08aefb09512f699748cc8fa8008e54cb97271028d6e9cfbb70c3d3686230d2446cbe39c9e0bc99a81c06cc5985409ea363c6d0283207379
TLSH
T1BCF04CD61065B1513612A623E7941BD767930DA81AC7DC844145B2704835E5C88A86E7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1968-0-0x0000000000330000-0x00000000003FC000-memory.dmp

Download

memory/1968-1-0x0000000000359000-0x000000000035A000-memory.dmp

Download

memory/1968-21-0x0000000000330000-0x00000000003FC000-memory.dmp

Download

memory/2176-12-0x0000000000B40000-0x0000000000C0C000-memory.dmp

Download

memory/2176-14-0x0000000000B69000-0x0000000000B6A000-memory.dmp

Download

memory/2176-24-0x0000000000B40000-0x0000000000C0C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads