urelas | d604a0fa6e418f6af90ff0c471252704b015c673c447efaf3eaa171a3fbc5e3e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe
Size 546KB
Sample261105-eepmzshx8j
SHA256 d604a0fa6e418f6af90ff0c471252704b015c673c447efaf3eaa171a3fbc5e3e
MD5 fbc3d3cc37d9d002b8df66d469a9fab0
SHA1 6cc4deabd1c9997f0d74d1fd4f16381f2407bf69
SHA512 03da7782fb13a6a3462268363467e900aa63d028ac5a3633b79b0d95507df39ddcbdbf4299305cdc8e0cd44aa53c6c99dd483db777ce644ae351f3bfd899a94b
SSDEEP 6144:u2Kw7lwFXUEeJi2xVCVxfwY+0QSyvmZ3INALzT1uj65CT1i6iSyYQM0JiS83G48D:u+GtVfjTQSaoINAHT1VQ1i3SyQEW85gg
TLSH
T195C4BE1136908476F36627750996E2F41AB97C384AA4D68FF7A83E395E301D38A3734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
4928	kiicw.exe
1344	dypup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5976	1344	WerFault.exe	93
1896	1344	WerFault.exe	93

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kiicw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kiicw.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiicw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dypup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4928	3260	2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe	89
PID 3260 wrote to memory of 4732	3260	2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe	90
PID 4928 wrote to memory of 1344	4928	kiicw.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_fbc3d3cc37d9d002b8df66d469a9fab0_elex_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\kiicw.exe
  "C:\Users\Admin\AppData\Local\Temp\kiicw.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Users\Admin\AppData\Local\Temp\dypup.exe
    "C:\Users\Admin\AppData\Local\Temp\dypup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 256
      4⤵
      Program crash
      PID:5976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 264
      4⤵
      Program crash
      PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1344 -ip 1344
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1344 -ip 1344
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 344a1d869f0693130398e09219ad480b4892dd2e9d1f3140688c79eb621a3615
MD5 4648127bbcbb9a29cfdd1590db22f25c
SHA1 2fdf38fbd6b2531983bdd546231210ccdbf4a42a
SHA512 a318599562bcff4c8e6aeeda6fb605389d4dcf769a7b204f23424814e2060b904d3e8ed7a2abf6a0480ef03ca011d23b1301aee89f78eff31216e133c2cf5e81
TLSH
T1BDE02600019B9E2D040CB02B09F9B20DC02468BC3F863F0DE620D79810CDD2DFAE7611
MD5 SHA1 SHA512 TLSH

Submit Download

dypup.exe

Path C:\Users\Admin\AppData\Local\Temp\dypup.exe
Size 231KB
SHA256 d76b8fe2527e7476879edae28070bb88ec1b574dff44b6aeb934ac2e36031f38
MD5 d3c314af2a77c4636069289e0146c2d7
SHA1 38783ca8caf730ee174b6fbf2e0f12b6e76a4ecc
SHA512 495f21606811bff3b14ef60a22c468b7e324951d0a42aa2936a901fa60c6c04abea31cdd0a042f7c0004d5aa9cd89fe9218dae04ef187fd405c75ab8053bdbc1
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpie:z6r5cTfS/ZPHUWoQISzqJBpie
TLSH
T18034D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 64fe41e0a94330d4dd0393e33d3496f4720585e7a8b53cf8f6079edba54477f0
MD5 c20449c8b50887efbc11c41f00a64902
SHA1 7b3861a86bf65add35d4d1b816dd591c99a6e251
SHA512 9fab15794345f569a7e798c5359f1cd111de4f3a675e20d53f4c3e9d71412a9d250bd04e0f1ac8f23e1f911e8e3b08a2d9701fdff36f4284a46f3acb30a4ece1
TLSH
T132F09BD520F5F1613712E612C3F41BA717E33D481E4FDCD4400573305976DCC4498296
MD5 SHA1 SHA512 TLSH

Submit Download

kiicw.exe

Path C:\Users\Admin\AppData\Local\Temp\kiicw.exe
Size 546KB
SHA256 44922f1e7adaf2c282c2337327a35e57c290c119f7de76b889c11e7f56d9a4f1
MD5 ce7b062c661c64540baaf870f5a826da
SHA1 459f537a85a9f290a67db2d1a1e5af1a8c8add89
SHA512 c967a6201c81806cb175b1134113073736c5eb880f3a690d28129f6ba277320c5e6415670f11b01bf829fb2f60afc38260147be7b2f606c6937eb67ac8c9aaa9
SSDEEP 6144:u2Kw7lwFXUEeJi2xVCVxfwY+0QSyvmZ3INALzT1uj65CT1i6iSyYQM0JiS83G48B:u+GtVfjTQSaoINAHT1VQ1i3SyQEW85ge
TLSH
T15CC4BE1136908476F36627750996E2F41AB97C384AA4D68FF7A83E395E301D38A3734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-36-0x0000000000070000-0x0000000000123000-memory.dmp

Download

memory/1344-33-0x0000000000070000-0x0000000000123000-memory.dmp

Download

memory/3260-1-0x0000000000E1B000-0x0000000000E1C000-memory.dmp

Download

memory/3260-0-0x0000000000DF0000-0x0000000000E7F000-memory.dmp

Download

memory/3260-20-0x0000000000DF0000-0x0000000000E7F000-memory.dmp

Download

memory/4928-12-0x00000000007A0000-0x000000000082F000-memory.dmp

Download

memory/4928-24-0x00000000007A0000-0x000000000082F000-memory.dmp

Download

memory/4928-35-0x00000000007A0000-0x000000000082F000-memory.dmp

Download

memory/4928-21-0x00000000007CB000-0x00000000007CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads