urelas | 9717fcfe43e3d7fb289147c4c4df5e19ab8f682f77392b9ce03944fe91c7d524

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 1.3MB
Sample261104-xcbbpaez6p
SHA256 9717fcfe43e3d7fb289147c4c4df5e19ab8f682f77392b9ce03944fe91c7d524
MD5 6432bb38aaa71b1b4d67c90ea097f601
SHA1 9092f5dc4b38d0182b50835b30dff880bab7fd98
SHA512 8c0276e92f4556d26964138975fd011a35d86aeee67aba626550e599368758d5b8396b097b5cd73054ad4e231aa0779dff8c2bae20c26ec930341b555fc9440d
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nF:+rt4/NArwjs5pAVj
TLSH
T10C551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	resom.exe

Executes dropped EXE 2 IoCs

pid	Process
5752	resom.exe
5260	nipeo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5232	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5372	5260	WerFault.exe	100
4968	5260	WerFault.exe	100

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	resom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	resom.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nipeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	resom.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5752	4540	2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe	85
PID 4540 wrote to memory of 5232	4540	2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe	86
PID 5752 wrote to memory of 5260	5752	resom.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6432bb38aaa71b1b4d67c90ea097f601_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\resom.exe
  "C:\Users\Admin\AppData\Local\Temp\resom.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Users\Admin\AppData\Local\Temp\nipeo.exe
    "C:\Users\Admin\AppData\Local\Temp\nipeo.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 216
      4⤵
      Program crash
      PID:5372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 236
      4⤵
      Program crash
      PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5260 -ip 5260
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5260 -ip 5260
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 ecf1d1735c7ba9011c291f8c6484a48b4b6f8d5b57e86eef6c9e623c77177bbc
MD5 6a043c10694cdad4e83e74018eb9129a
SHA1 aea15993d71aeddd543ac5e1f1ff2d9e1032bd8d
SHA512 3731586aa5091eb1f45dec298d91b9d1d6e50f35e33aa454125b196f3e9c5864686e7550f156a7f178e19a9b4f5599563ac1097674fb6c4e7bb3b6c977c2b115
TLSH
T1DDE0D851199ECF6D010CD02B097DA04DC2714DE8AF8A2F0C5729CA4D22DE82E75D6332
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 681adefeab54269a52a6577b6b6e33fe18e0c1e4dfd171a244611f3f0ee1d6ba
MD5 8c99b7a2a5e117d0a3b7f27dbdbe74f9
SHA1 112f2544e9a31ab7633ec5a42201f16589912aed
SHA512 adf94a943cce5ea839a8648aac1cb84d2e753f879daba0ca7b01053a29811f17a3d1a51c9ddab8b61dd1ec3dc6541dcce71b2a0f86e83beafa8354bcb6dff2e8
TLSH
T14AF02BC110B0B0D23601E213EBC0070D33A38D8818838C840614B2304C75C3C8440742
MD5 SHA1 SHA512 TLSH

Submit Download

nipeo.exe

Path C:\Users\Admin\AppData\Local\Temp\nipeo.exe
Size 231KB
SHA256 7c0c18c8347bdc9a587d8da9dd3d29761f0efe36ddb63067cf6a28938401ddd2
MD5 c79f09e828680bd51afd5d81dba79687
SHA1 d894ba778bd423b968eee9a863b8d7fb79ffbdda
SHA512 d2e0f4ec83f93671b70836f94297a4f81cfe584e3ca282d14c147bbf2aeff125cf53e536b75eaa70982a397dcac88ca3a5ade35f1275ec0a6e4b9015f8e61fb4
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpi7:z6r5cTfS/ZPHUWoQISzqJBpi7
TLSH
T12634D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resom.exe

Path C:\Users\Admin\AppData\Local\Temp\resom.exe
Size 1.3MB
SHA256 3a23c794aeef6fbaa08249a441dc2e2c6f7c58a5e8037719aac92ee455f9dd90
MD5 9a8bfea41ef0787da7d3dbac4b8f98a9
SHA1 de7030aa7ff7e4be3aad1643d841fb8fa549216d
SHA512 2c24fd329966e50326f10ff26b3b3b19d04dc0479d3ba95b6c72352875e99ceff038783dc382e955cd07500b67ae1585df5752f9a008b9e4cb649c1f7b50f6a4
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+nb:+rt4/NArwjs5pAVh
TLSH
T1EB551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-0-0x0000000000760000-0x00000000008B7000-memory.dmp

Download

memory/4540-1-0x000000000078B000-0x000000000078C000-memory.dmp

Download

memory/4540-16-0x0000000000760000-0x00000000008B7000-memory.dmp

Download

memory/5260-28-0x00000000001F0000-0x00000000002A3000-memory.dmp

Download

memory/5752-13-0x0000000000A3B000-0x0000000000A3C000-memory.dmp

Download

memory/5752-12-0x0000000000A10000-0x0000000000B67000-memory.dmp

Download

memory/5752-19-0x0000000000A10000-0x0000000000B67000-memory.dmp

Download

memory/5752-29-0x0000000000A10000-0x0000000000B67000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads