urelas | 95f6427c0a34b640e1b8fc27745eac38bacd47ef5a968d0bf42cfc5e5937347a

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 694KB
Sample261104-n8447s1vbv
SHA256 95f6427c0a34b640e1b8fc27745eac38bacd47ef5a968d0bf42cfc5e5937347a
MD5 a1eedb77253ff52d34da2fd078a6fc2b
SHA1 8f78f321076dd2b93d6000b819d69b12390de833
SHA512 c28d06f96eed14617a177a49c6ac4f35af0e3853b6e2546bf81d674df8a19175dc6061dc4eaae147680cb35c055b387aad59525e38704df7e36dc7fd16640c85
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nre:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnre
TLSH
T188E4F1216180C038F3AA077689A2E1E51A297D785790E58FF7E87DB65A311D79B3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a332-31.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1332-38-0x0000000000400000-0x0000000000596000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1332-48-0x0000000000400000-0x0000000000596000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4864-0-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c481-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4744-18-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4864-21-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4744-24-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1996-25-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1996-26-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1996-45-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
4744	sioqk.exe
1996	lupyxa.exe
1332	lefou.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe
5652	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lupyxa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lupyxa.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lupyxa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lefou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sioqk.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe
1332	lefou.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4744	4864	2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4864 wrote to memory of 4116	4864	2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4744 wrote to memory of 1996	4744	sioqk.exe	92
PID 1996 wrote to memory of 1332	1996	lupyxa.exe	94
PID 1996 wrote to memory of 5652	1996	lupyxa.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_a1eedb77253ff52d34da2fd078a6fc2b_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\sioqk.exe
  "C:\Users\Admin\AppData\Local\Temp\sioqk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Users\Admin\AppData\Local\Temp\lupyxa.exe
    "C:\Users\Admin\AppData\Local\Temp\lupyxa.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\lefou.exe
      "C:\Users\Admin\AppData\Local\Temp\lefou.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1ee3010cc3130e6fafb047a5339136795d6dd81fc2c5978327a0c3bdcc103f15
MD5 48b481838ae3e05105da28d68a3517a6
SHA1 8ad2294689c2086d3a1805f9cde3280e775aab6b
SHA512 c12affb4c9093a1166cba21bbc9036d150154176a7cd96651bdf46e9ec1e515c643382bd72fe8a38124669ca646524758c315169eeaa34f8194f50955cc610c7
TLSH
T151D0C7124ADAD79F4848902B0AF5618DC0754C9C3F477B119725C4CD21C141DF5C7351
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 ef44913ff4dbfd0828df5e0c1b7d4ddf47a98aac1fda02ca7465a9e5b98e799a
MD5 f933ce999590a8d937c470c38faeae60
SHA1 7963224b47c672d38c12b2ac6c423bff335462c3
SHA512 4baf666533997fc9e1d8807ef3c4db63528b78501de94579b10231b252582b5a254bc3428783c6af9dc85f4dcdbd8e99232efd8d469141565194cdcd1c55d447
TLSH
T133E0920181DBE93F0648C41B0AF5A69D815096A87F9A37F57A11C99C53E982EF6A3282
MD5 SHA1 SHA512 TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d063fd72dcd9af5f863883539b7248d3b5460ece1456dae7037f91ab628a0873
MD5 f97733ef5c3c579c09a8f5d89f470bcd
SHA1 62bdcf9abae7ab05483b5d5f9552eff5db637e0e
SHA512 5d05bdbc416b914baf664b0ec3624310147085482c0b12120b37bd1ec8d9efa55ec1ec369d6592204d4694263f38cd2bd5380c1e9d318acda439051e5d22bd84
TLSH
T126F09BD521E1B44A7911F233E3C41B9927D31D5559479D741505B1704DB9C7C4544355
MD5 SHA1 SHA512 TLSH

Submit Download

lefou.exe

Path C:\Users\Admin\AppData\Local\Temp\lefou.exe
Size 469KB
SHA256 69374132915cd9318aee36440fe73b1c84f1a391c705baa53d38ef51a9d3af27
MD5 410f22ad1e269c3e2cc925e7cd2ca304
SHA1 5510dd1249facc4b797a697498214ebf21524c5b
SHA512 8edaacf559029e25b30fd7e2afd1593d50bd1b13a4bec6e91562997ee9d4897afc2f485b685aa2abf6be34e8f5d4bd3027d34bed5dc37a2c92e1230aaec1c4ee
SSDEEP 12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+7A:RIbq0ft8gLvoko1hmkQ5cXzyvL/p
TLSH
T143A4238E0D48B305EB396637379E3F48A130DE12C50A6B3766EDF1696F732506D921E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sioqk.exe

Path C:\Users\Admin\AppData\Local\Temp\sioqk.exe
Size 694KB
SHA256 4d4beae1293a15aa7c2d524c6d8a0bdf1c83f506e1a4dba89c304829ffaf3785
MD5 722215c3578712231c0470fbc6e248a9
SHA1 d4fb5e2df0d52acad85116e16bbbfc68e208a987
SHA512 6f09c432b914514a2eccdbfa57fa17618c53cf27906012d50f79c720e60d42cf0e506084fb8228a870b3d7c47596b5e8c88278195c312306b46f2f60a94bfbbd
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nra:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnra
TLSH
T1B9E4F1216180C038F3AA077689A2E1E51A297D785790E58FF7E87DB65A311D79B3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-48-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1332-38-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1996-45-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/1996-26-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/1996-25-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4744-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4744-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4864-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4864-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/4864-1-0x0000000000423000-0x0000000000424000-memory.dmp

Download