urelas | 856315ff056878e1e19de6969b50d6d6cb849eab876d97aaf439594635ab4a38

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 308KB
Sample261105-e3e4fsfw9t
SHA256 856315ff056878e1e19de6969b50d6d6cb849eab876d97aaf439594635ab4a38
MD5 f87a58618aa60b8604c1fc07b8f5bdb4
SHA1 3b8eb715cfaac78df12cf3494f6d579b3f78cf93
SHA512 32e7925e930d387e5543bf1fad66c2f16e205adca9c3c91ee48c20fe1d01309839158e3c6be65c27abcf0d31819331ea43e5d382ec0fe5e6c31fd204d3f48473
SSDEEP 3072:BQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopBE4H:BQi+reSUbnbA8VKQq8hpW6p75PpBE4H
TLSH
T150649C113980C4B2E76A07310406FAE44A6AAC3E1B95E58FF7787DB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
2964	coejz.exe
4736	sakulo.exe
756	hiwal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5428	cmd.exe
4100	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sakulo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sakulo.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coejz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sakulo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hiwal.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe
756	hiwal.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 2964	5764	2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5764 wrote to memory of 5428	5764	2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 2964 wrote to memory of 4736	2964	coejz.exe	93
PID 4736 wrote to memory of 756	4736	sakulo.exe	96
PID 4736 wrote to memory of 4100	4736	sakulo.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_f87a58618aa60b8604c1fc07b8f5bdb4_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Local\Temp\coejz.exe
  "C:\Users\Admin\AppData\Local\Temp\coejz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\sakulo.exe
    "C:\Users\Admin\AppData\Local\Temp\sakulo.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\hiwal.exe
      "C:\Users\Admin\AppData\Local\Temp\hiwal.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 253f28f63ae82c8a97d4360d2500360ff808d59f2e4f9539ce401f39bf2eeae7
MD5 5618bf4b46d3a1ed97b4d59778f57c6d
SHA1 fef433ac6f7463d8d8d4219afd4abe60bd4883b9
SHA512 42a392f1892207b9318c7ded9268d82af8a7911e4d5e11f016e222e05416d56ce1652d51d110361e981b75bfcc72020972b13f88bd4d178faf382cee83ce7969
TLSH
T1DCD0C91181DADB6E0848A53F0AB5628DC0759CAC3F8B3B11AB25CC4C62C281EF6C7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 4c04ba468128cbf10c081e7a0d2e0650f1fb7e33cee5e42e16f226dd2849eb61
MD5 3ef4196731f23cc3116684acc282c814
SHA1 2d3fc1549eaf7cbe4b314c686c838b7fa13a7374
SHA512 7634b4474adee885d2cdab96cb76f91b590d6eac25d8df8da73b69f5e411d4233028661e8287d08f1a4e1d3d8fb0181abf69d65cb5b2e9fd2913482cdf65e655
TLSH
T1F3E02045024FED67060CE11B07FA654DC5648EAC7E8637747721CA5C62D1C7EF5E3202
MD5 SHA1 SHA512 TLSH

Submit Download

coejz.exe

Path C:\Users\Admin\AppData\Local\Temp\coejz.exe
Size 308KB
SHA256 f509db9d0d7ff3235426d0a3cecc0fa683922f21cc328cb05d3810c2bdb1ccad
MD5 91760d6473b09428b326cd60c4b5b33b
SHA1 f851a2a3636ebca5a9daa2a424bef0100369b15c
SHA512 cc2a8b757a520dc13c87340e7d0f346d3470a891ed0ad5db03c66f57a953240a35a2b3cadd575bcd8579b72c3592131f897f90f404c37d7e8b80346449bf0d46
SSDEEP 3072:BQisJFjI/DmZwx0eJSUbx3ECbZS42t8sJ4yYdfp4Qz28h+0W6Y4704jGopBE4E:BQi+reSUbnbA8VKQq8hpW6p75PpBE4E
TLSH
T1AA649C113980C4B2E76A07310406FAE44A6AAC3E1B95E58FF7787DB968311D3577B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 206374ef724986909f6ef1c4bf70fe730de02e767eb924ddc732b8061a080a45
MD5 07d009fbdaee4269c337f277e971ba21
SHA1 1b0b0e7de666e3c9f9570b3fb215bc0d3f8caf47
SHA512 e747057360dcfba300c5095dfb7c501562f261f800ccce5f698c9fd84030bae60358f4715f18583c4e85adf77c2ea322f535e1a96a4d5d94cd84ed87b25e7d8a
TLSH
T14AF08CCD1051E0143612D221C29043981B830C4C19879C640248B170893AB2C40103D2
MD5 SHA1 SHA512 TLSH

Submit Download

hiwal.exe

Path C:\Users\Admin\AppData\Local\Temp\hiwal.exe
Size 111KB
SHA256 edbf6bcf061ab2d0c44b10a7747db6ed73c6fd03a98139e3f7c6f92059042b35
MD5 a381ca022f0ce7525a65705471ce1469
SHA1 01f3d6d3656df8ca29667f64171cf2ba94d4dca1
SHA512 693dac09390a76b64124a646a23beb54770282da3774e15edb1180b1fb546a15edf4a37f8930cb3e53b144ed478a163f9c9334c2ffa2be498825590e9b0f51cf
SSDEEP 1536:jH21ZVCMSo4l3nhZgnDuJsJV1/1WpkUCVBZXwvZ4Xw93DgN1:jWrW53nhZSuJ21/fUCHhwdDm1
TLSH
T1BDB3D043A60088A8F71C0B311942F9E054A59E3C69E9F50FF13C7C7AB9B21975AB319F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-50-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-53-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-37-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-55-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-45-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-54-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-51-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/756-52-0x0000000000DF0000-0x0000000000E78000-memory.dmp

Download

memory/2964-24-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2964-18-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4736-25-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4736-26-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4736-48-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5764-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5764-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5764-21-0x0000000000400000-0x000000000044C000-memory.dmp

Download